Bar to entry is extremely low; copy-paste existing contract, change a few variables and launch. Yet, the contract must resist state-sponsored attacks, eg. https://rekt.news/big-phish/

Maybe one day there will be a sort of unhackable template that everything derives from, or an automatic software-prover.