I am not sure what you are trying to say.

Security is a gradient. At some point, adding security means reducing freedom. It is a societal choice where you stop. If you put all the humans in your country in a jail, each in a separate cell, never let them go out and just bring them food, then there will be no crime in your country. But nobody wants that.

> I think this principle applies to every single type of social engineering attack. Limiting the context of permissions lessens the risk of a confused deputy.

A confused deputy is a computer program. We're talking about phishing.