[adrianN]

IMHO it is often the case that security can only be achieved if the design is sound. Overly complex designs are very hard to make secure.

[justicezyx]

Sure, but still they do not dictates implementation details. And that's different than what OP saying.