Security is not goal in itself, although many IT types seem to think it is. As you note in your second paragraph, it's a sliding scale, to be weighted against productivity etc.