There do exist rigorous security standards that have been theoretically and empirically demonstrated to distinguish "secure" from "insecure" as long as we take

There do exist rigorous security standards that have been theoretically and empirically demonstrated to distinguish "secure" from "insecure" as long as we take those terms to mean something meaningful like, "can protect from state-level actors" and "can not protect from actors of average skill" which constitutes a difference of literal orders of magnitude. In fact, it even comes in the form of internationally recognized standards such as the Common Criteria (ISO 15408). In the general space of multi-level systems enforcing isolation between untrusted code and trusted data, we can look to the SKPP [1] or the Orange Book Class A1 [2]. [1] https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf [2] https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/dod85.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap...