> If they aren't qualified to know when security must exist, they are not likely qualified to implement it Actually that's incorrect. It's simple to add a Lets

> If they aren't qualified to know when security must exist, they are not likely qualified to implement it Actually that's incorrect. It's simple to add a LetsEncrypt cert in the right way -- but not easy to come up with all possible ways people might want to attack your site. @kerkeslager wrote: "But there is always incentive for bad people to hack a server ..." Those are good reasons, the ones you listed -- and yet another reason is that someone might want to use your website or app, to break into someone's else's website, e.g. by adding a link to, say, Google's login page, but the link is in fact to a password stealing site. -- And it's impossible to know when or if someone has the motivation to do such things to some of one's visitors / users.