[teawrecks]

And what do you do when the only way to support a new feature on a legacy system necessarily introduces a security risk? Special case it?

[rossipedia]

That's a hard problem to solve, and I don't think there are any easy answers. It depends on many factors. What kind of business, what the risk/threat model is, cost/benefit analysis, all that kind of stuff.