Talking about risk mitigation in hindsight as unnecessary is a very bad view of risk management, especially for someone who is supposedly an expert at it. You

Talking about risk mitigation in hindsight as unnecessary is a very bad view of risk management, especially for someone who is supposedly an expert at it. You don't do risk mitigation because things will go badly, you do it because it could go badly. Or alternately, you could use "password" for all your passwords, after all, if no one ever breaks into your accounts, there's no reason to have bothered with difficult passwords.