Sure, that's the legal environment we find ourselves in, and in many respects it's short sighted and counter productive, i.e. it actually fosters weak security in critical settings and the chance of those weaknesses being taken advantage of by malicious entities.