What about storing sensitive data in something like a HSM, which rate-limits access rate, so you could only lets say access 10000 records per day. Yes, develop

What about storing sensitive data in something like a HSM, which rate-limits access rate, so you could only lets say access 10000 records per day. Yes, developing against such a system might be annoying (think about updating a new piece of data for all records). But it feels to me that we need a way to rate-limit access to sensitive data, to prevent wholesale dump in a short time. But you still need other systems in place, to prevent a hacker lurking around for months until it gets all the data.