And there is an argument for not being able to afford the effort in that scenario too.

At the least, risk will be higher than it needs to be, and that puts the other validation into question as well.