> it can’t guarantee it will be secure down the line ?

Then no business can handle user data?

There's no such thing as a guarantee. You can do what you define as the best effort to secure it, but you can't guarantee it will be secure.