Problem is that 'rewrite later' never happens because you're always busy. Setting up safeguards to protect against common attacks is quick enough that it can be done upfront. Efficiency and scaling can usually wait, though figure it out ahead of time if possible.