The decision on how much effort you expend to secure your particular system(s) often comes down your perception of risk and reward (and it's worth emphasising t

The decision on how much effort you expend to secure your particular system(s) often comes down your perception of risk and reward (and it's worth emphasising that word perception too). There's usually a cost associated with greater security[0], and generally a balance that is struck. You can argue whether a particular system should lean further towards security, or further towards lower-cost, but ultimately there'll be a judgement call. I'd suggest there isn't a single correct answer for this. [0]whether in actual dollars, ease-of-use for users, time-to-market or possible reduction in feature set