I expect the idea is less to prevent any possible threat and is more a) to comply with regulations and b) to log enough data so if somebody does circumvent your

I expect the idea is less to prevent any possible threat and is more a) to comply with regulations and b) to log enough data so if somebody does circumvent your legally required measures, they've left enough of a trail to hang themselves.