Isn't that supposed to be the whole point of these security reviews? To tell people where the line is? Saying "just do more because it's the moral thing to do"

Isn't that supposed to be the whole point of these security reviews? To tell people where the line is? Saying "just do more because it's the moral thing to do" is not a convincing argument, because it doesn't tell anyone what "more" is.