It's always incapable product owners and business people who don't understand security but think they do.