I think your category 3 could use a lot more division. It's mostly possible for a skilled team to build sites that can defend against targeted professional att

I think your category 3 could use a lot more division. It's mostly possible for a skilled team to build sites that can defend against targeted professional attacks (e.g. crime gangs) - at the very least you can make your systems expensive enough to attack to dissuade them, and (depending slightly on what you're doing), potentially completely inaccessible to them. It's not easy to do that - you need to design your systems with many layers of defence, e.g. you might design your systems so that that 3 or more independent and unrelated 0days are required in combination, which is likely out of reach/budget for most targeted attacks. However you also included nation states in the category. Defending your systems against targeted attack from a sophisticated nation state is so close to impossible for most groups of people that it shouldn't be in anyone's security model[1]. While I don't agree with many points in the article, there IS a concept of unhealthy security absolutionism (nothing to do with cloudflare, though). Parts of the infosec industry have a tendency to declare things broken and unusable if we suspect possible compromise by a nation state - we should not do this[2]. VERY few users can reasonably expect to defend against these attackers, and telling people not to use $tech because it's suspected to be vulnerable to this is a disservice to users. Note that the above strictly relates to TARGETED attacks by nation states, bulk collection and surveillance is very different, and more practical to defend against. 1: For groups that DO need to defend against nation states, this doesn't apply - but then for those groups there is no substitute to having highly skilled people directly available. A bit of googling isn't going to save them, and thus simply having a footnote of "If you're defending against the NSA, this doesn't apply" is sufficient. 2: An example is the NIST ECC curves such as P256 - around the time of the Snowden leaks, there was some speculation that the constants used for these curves were chosen by the NSA to make them subject to some unknown attack, and therefore some (even some respected sources) advised users not to use them. This, in my opinion, was bad advice for most people.