Same way we draw the lines between risk and reward in everyday life while still managing to function. Doing that with software can be a little less intuitive t

Same way we draw the lines between risk and reward in everyday life while still managing to function. Doing that with software can be a little less intuitive than stubbing your toe and learning from the pain, but it ends up not being that hard to maintain a low resolution threat model when you prioritize well. A user with a basic habit wouldn't need to know how to read the code for this, because there are enough signals that you wouldn't need to get that far to decide not to use it.