Most clients will not agree to pay extra for a more secure web site though. Unfortunately. Unless they’ve been bitten in the past, which most businesses still haven’t.
Taking options off of the client’s table is the core responsibility here.
In the end, it's all business decisions. If it's something I don't like as a customer then it's to be infantilized.
(If you disagree then please don't complain ever again about LLMs refusing to help you reverse engineer a piece of code or explain how a virus works.)