> You can't create "technical debt" if you don't change anything in the first place.

Tell that to your security team.