Yeah, you stated my intent better than I did. Most pentesters I've worked with would show a bash history and say "look, you failed, fix these" and my client would get mad at me for not securing this even though this isn't what would get you hacked. It's like a home security company recommending you keep your cell phone in a locked safe at night instead of on your nightstand. Sure it's safer, but it's really inconvenient and a good home security system would notice the robber kick down your door before your phone even gets stolen.

The idea of any security system should be to compliment normal business operations, not to hinder them.