I do understand this sentiment, but isn't the tension here that security improvements by their very nature are designed to break things? Specifically the thing

I do understand this sentiment, but isn't the tension here that security improvements by their very nature are designed to break things? Specifically the things we might consider "bad", but really that definition gets a bit squishy at the edges.