I think you are making a wrong analogy here. A "threat model" in security is like a "user operation" for the feature. So in the non-security bug world, the exc

I think you are making a wrong analogy here. A "threat model" in security is like a "user operation" for the feature. So in the non-security bug world, the exchange would look like: Bug report: the program is missing blue circle in the top right corner. Please add is ASAP. Developer response: what would possibly be the use of this feature? Please tell me of I will close the bug.