Good question.

First, I'd look at setting up automation and boundaries. If I'm launching a new service and it's insecure, hackers shouldn't have free reign in the datacenter, say to send RPCs to any other service they want. It should be like a public cloud. Or if a config file was edited in a way that's malformed, the solution might be to have automated tests that run as part of presubmit. There should also be clear documentation of dos and don'ts that you wouldn't have to understand all the implementation details to use effectively.

Beyond that, some checks will always be required. My post was intended as more of a "if possible, do this instead of that" than in a binary sense.