That‘s fair - nonetheless; identifying the biggest risk to a policy change as referencing the attack vector - not the attack vector itself should ring some alarm bells.