It seems to me that this point is addressed by the author: Our threat is really from folks doing large-scale automated sweeps for low-hanging fruit > The atti

It seems to me that this point is addressed by the author: Our threat is really from folks doing large-scale automated sweeps for low-hanging fruit > The attitude described here makes sense for embedded, non-networked systems. It’s certainly fun to work on systems like that. Well, more and more you are required to put encryption everywhere even when you are not connected to the network. Some certifications require that your device is protected against physical tinkering, even though it is inside a metal box behind a locked door in an access-restricted area. Sometimes it feels like the "defense in depth" concept is not understood at all, because the requirements are written like if each line should be unbreakable no matter what. I think that computer security is a noxious domain because it is so easy to FUD people; it is a domain where risk aversion has a field day any day.