The purpose of a retro is to identify a process that will keep some bad thing from happening again; a process that keeps the bad thing from happening for any re

The purpose of a retro is to identify a process that will keep some bad thing from happening again; a process that keeps the bad thing from happening for any reason is strictly better than a process that keeps the bad thing from happening due to malice. If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. To extend your analogy, it's the difference between locking your house (which protects your valuables from thieves, but not your garden hose and wheelbarrow from your drunken neighbor) vs. locking your shed as well.