Re: They should be ...
"There's a hole in my bucket, dear Liza, dear Liza..."
A common problem is that client side devs disable the security to get their applications working, and then neglect to enable it again before they go live. Sometimes, they develop applications that won't even work with security enabled.