I've seen the term checkbox security in docs from the 1980's. Vendors delivered an insecure products, e.g. with default passwords. It turns out nobody knew ho

I've seen the term checkbox security in docs from the 1980's. Vendors delivered an insecure products, e.g. with default passwords. It turns out nobody knew how to secure these products, so vendors reacted by blame shifting: Provide lists about how to secure your products, and niw blame your customers for the insecurity. Customers didn't want to be blameable so did anything to check all boxes. All in all, I think it's a step up from what came before. A security problem is invisible until you get attacked. Then random unrelated people get caught up in the fallout. Checkbox security moves the pain to inside the company, where internal forces will provide pushback if a requirement is too onerous. That pushback is exactly what happens for this overly onerous requirement here.