It is either "overkill" or be sued, should something terrible happen.

If someone accuses an entity of having security that is not tight enough, that's called legal liability in our lawsuit-happy society.