If I had two experts, one of whom was security and one of whom was business, and they disagreed with each other, I would also be listening to the security expert first.

After all, there have been major catastrophic failures because some IT tech followed the orders of a CEO to give them access to a mission-critical system from their insecure home PC. Isn’t that essentially what the whole “but her emails!” (and, it turned out later, his emails) was all about?