Aren't the point of the standards to ensure there is no room for security holes? It seems kind of strange to make the security dependant on the implementation.

Aren't the point of the standards to ensure there is no room for security holes? It seems kind of strange to make the security dependant on the implementation. Imo, it should be impossible to implement the standard in an insecure way.