This is good advice. One other idiom I would add, that may not exactly be security specific, is: "Expect your software to be misused - and make it very obvious

This is good advice. One other idiom I would add, that may not exactly be security specific, is: "Expect your software to be misused - and make it very obvious when that happens."