I think that’s perfectly legit. They’d go on thinking everything is ok if nobody yelled. It’s probably something the devs just didn’t consider. I’ve lost count of how many times something I’ve written has been nuked by a change that was done in the name of “security.” I’m pretty sure to get a job in data security you must prove that you’ve installed a double-walled steel door with deadbolts, padlocks, cameras w/ 24/7 monitoring, and an access approval policy on the bathrooms inside your own house.