That's passive vs. active security. You can always go back and figure something out, but why allow for the potential at all? It's this type of attitude that continues to have developers ignore basic best practices around security when writing code.

It's all a series of defenses, the last one you should ever rely on is piecing together what happened by video camera... what happens when they install a root user, or ssh authorized key on your system and then do whatever they want at some other time?