3 is reasonable. I think you stated that well, "the user isn't actively trying to circumvent it", though I might expand that to include the application isn't ac

3 is reasonable. I think you stated that well, "the user isn't actively trying to circumvent it", though I might expand that to include the application isn't actively trying to circumvent it. For passive mitigation of standard browsing as a means of helping protect yourself, yes, but even there, it won't take long for systems to figure out a way to circumvent that.