Let's qualify that - it's an entirely appropriate way to deal with security with the current climate of not actually having any repercussions (or none beyond so

Let's qualify that - it's an entirely appropriate way to deal with security with the current climate of not actually having any repercussions (or none beyond some tepid market response) for security breaches that damage third parties.