This applies if you are developing your own software. If you do security for an enterprise with dozens or hundreds of apps that you don't develop yourself, you

This applies if you are developing your own software. If you do security for an enterprise with dozens or hundreds of apps that you don't develop yourself, you might not have the luxury of only trying to reduce attack surface, or instrumenting 3rd-party supplied code.