I would think twice before using a service that makes no effort to protect me in case of thieves or wannabe hackers. Of course, degrading the service because of security is an old and very common problem, but maybe the sweet spot would be to degrade it minimally, so that everyone gets a lot more security for just a bit less of Magic®?

Well, with Magic there is almost always a geographic aspect to fulfillment which would ward off most/all theft attempts. The time to perform risk mitigation is when a strange, large request comes in.