Until someone repurposes that thing to do something that is security-sensitive and forgets to remove the comment, misleading the next auditors.

I always assume that people from the future who are going to touch my code are really dumb people, so I try to have as few traps as possible for them.