It also sounds a lot like lawyers arguing that cybersecurity is broken, so you should replace part of your dev team with a new type of contract and some lawyers

It also sounds a lot like lawyers arguing that cybersecurity is broken, so you should replace part of your dev team with a new type of contract and some lawyers to enforce it (I'd say this does't actually happen because lawyers aren't that daft, but then I remember really long EULAs with really silly clauses...)