> But you don't assume that the network security actually works, you don't allow its existence to degrade the rest of your security story.

If you implement security at the network layer, what’s to stop app developers from kicking the can down the road rather than implement app security?