Why would it not rely on both ? Why would any security measure not have an additional security measure ? In my opinion there is no such thing as a “good security measure”. There are only security measures that haven’t been broken yet.