[SilasX]

The smallness of the change doesn't affect the point I was making. [1] The point is that you can't simply look at the raw incidence rates and conclude that specific added countermeasures are unnecessary or irrelevant to the attacker's incentives.

If you agree with that, then you agree with my general point and it's just an issue of which specific countermeasures survive a CBA.

[1] In fact, I chose a small change specifically to highly the absurdity of being bound by low/declining attack rates.