[uladzislau]

You should consider the assumption that your security IS compromised at any given point in time (bypassed or whatever) then you could foresee and prevent some worst case scenarios which usually come from hubris nonetheless ("hey, our app is 100% secure and tested by the top security experts - not like other apps on the market").

[jt2190]

This point can't be emphasized enough. Sophisticated operators always assume they're being listened to, and take precautionary steps.