I feel in particular your second point is similar to a security officer. Their job is to identify risk and propose the safest approach. But in extreme, the safe

I feel in particular your second point is similar to a security officer. Their job is to identify risk and propose the safest approach. But in extreme, the safest approach is to shutdown and do nothing - the only truly unbreakable system. For any functioning system, ultimately a business owner will need to decide (formally and explicitly, or informally and implicitly) what risk they're willing to accept to proceed. What you're saying I think is that you should be informed enough to have an intelligent conversation with your attorney, and be able to make decisions on what risk they point out you're willing to take, and/or how you can mitigate it without just avoiding/shutting down?