Reasonable plan, until your service needs to interact with an external service (esp 3rd party). Then what?

Perfect security is commonly unusable and therefore often useless, because the business requirements still come in and need a solution.