That only means that if you need these kinds of security guarantees you need to look for another solution. A bad software would be one that advertises security

That only means that if you need these kinds of security guarantees you need to look for another solution. A bad software would be one that advertises security but in practice the implementation would be full of holes, for instance with Microsoft Active Directory: https://arstechnica.com/security/2025/12/microsoft-will-finally-kill-obsolete-cipher-that-has-wreaked-decades-of-havoc/ https://arstechnica.com/security/2025/12/microsoft-will-fina...