> because the client's corporate IT only cared about ticking all the boxes on a security conformance report.

Yeah, I'm aware it used to be in conformance stuff (and probably still is in many cases). Super annoying when that happens :)