> A company who it didn't affect much, spent 100s of our hours? I think it would reasonable to call that onerous.

100 hours is 12.5 days. That is not much to protect your users data.