Well said. I blogged about this same thing about 3 years ago (http://web.elctech.com/2007/03/01/securing-your-models/). It's amazing how many application I come across that don't protect their attributes.