And there are plenty of things that were one convention that are wrong. Along with plenty of implementations of security that actually aren't good.

If security is a goal, there is a difference between doing anything and actually having a secure system. There is also such a thing as secure enough.