A threat model can include hackers while not taking every action that could prevent every conceivable attack from a hacker.