Definitely. Focusing on security before your first data breach or security assessment is called premature optimization, and it's a serious anti-pattern, because

Definitely. Focusing on security before your first data breach or security assessment is called premature optimization, and it's a serious anti-pattern, because it wastes valuable resources that could be spent increasing the threat surface. (This is sarcastic, as I assume the original comment was)