No, it's because you provide a choice between "we have a process that includes threat modeling..." and "we have no process", thus excluding the vast middle ground of people who care about security but don't hire consultants.
You just need to think about the security implications of what you are going to to, do it keeping in mind all that could go wrong, check again what you have done, and keep a spreadsheet registering how well you are doing. And do it systematically.