Either it’s secure or it isn’t. If it isn’t secure then it doesn’t matter if there are only 1.3 million people in the country; I promise someone from outside the country will try to break it.
That seems to me like a justification for doing the least amount of work needed. Sure, it's true to some degree, but (taking this case as an example) PKI is objectively uncountably better than a PSK-like structure. There's a base security level and until that's reached, there's no need to expend money and time or inconvenience users to gain greater security. Anyone who doesn't get to that level while designing a project of any importance is a lazy idiot.
Actually, it needs to be both secure and easy to use to work.