> You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing?

You are - you're literally arguing for it right now. Short sessions just don't help all that much, and they have an outsized impact on users.

Why are you dying on this hill? Likely because your mindset is "security above all else" and that mindset is literally cancer.

Security above all else leads to a product that does fuck-all else (and it does it poorly).