Like developer experience roles, maybe security departments need specialist 'user experience', teams or ICs. I think there's fertile middle ground here between anarchy and the received wisdom on 'best practices'.