SolarWind, enough with the password already
I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach it.  They're not going to send someone after the password protected parts, they're going to send your recruiter the most irresistible candidate--the perfect background, right out of your favorite school and with expertise in exactly your tech stack.  You'll get pages and pages of glowing recommendations from people inside and around the industry.  They'll ace your interview loops, be loved by all your engineers and managers, and they won't bat an eye at the lowball first offer you give them.  They'll move up the corporate ranks with ease and be everyone's friend... and then the best security in the world doesn't matter one bit.