Exactly. One of the first things we learned in my UNDERGRAD security class is that &quot;good&quot; security which is unduly onerous will just make users route around it and revert to plain old bad security. The canonical example was ridiculous password requirements which just make people put their password on a post it on their monitor.<p>As you said, security requirements that are that onerous and too rigid to relax when necessary is just shittily designed  security to begin with.