IMO the standard should consider both industry best practice for securing sensitive data in proportion to the sensitivity, as well as intent. Like it's harder t

IMO the standard should consider both industry best practice for securing sensitive data in proportion to the sensitivity, as well as intent. Like it's harder to argue breaking and entering if you secure a door with a bent clothes hangar or carabiner vs a padlock, even a bad one. (Clarifications welcome.) Incrementing integers are like the carabiner, a botched JWT token implementation might be like a bad padlock, etc.