I think this is just another way of saying "avoid gold-plating." Building a new service to stand up to millions of users and nation-state attackers is probably

I think this is just another way of saying "avoid gold-plating." Building a new service to stand up to millions of users and nation-state attackers is probably overkill until you know whether anyone actually wants it. That said, there are definitely early technical decisions that will be very painful to change later on, like how you authenticate users and protect PII.