 We like to push that model to the left and ship in a secure by design state, but still make the software applicable for most use cases. CISA coined a phrase that I use almost daily, less hardening guides, more loosening guides. By shipping a secure product, you have that assumption of security on day one, but still the flexibility of making it fit the use case where you have risk mitigations in place.