Having been burned repeatedly by the primary problem you mention, I lean more towards the second case simply because security depends on the application involve

Having been burned repeatedly by the primary problem you mention, I lean more towards the second case simply because security depends on the application involved and how it's used. An insecure app may have mitigations available that don't reduce its usefulness. A broken app is just broken and useless.