This is one of those cases where the "secure app" narrative collides with how messy real systems actually are