Could as well be. Properly managing access controls for a complicated data platform might actually be harder than securing the software to begin with. Setting up protocols for who is able to access what and why and who is in charge of changing the config is non-trivial.