What you said can be generically applied to every security control and which is why security is hard.