>I never understood "security people" who would spend a week hardening their OS but did nothing about their locks.
Very different threat models. Computers are available to anyone on the internet or the authors of any software I choose to install; remote attacks require very few resources and are common.
Physical attacks are different. The odds of anyone choosing to attack my particular house are very low; they can't attack thousands of houses at once, so basic techniques such as "being slightly less attractive than my neighbors" work well. As a standard residential house, picking the lock isn't the way anyone's going to get in. They could break the window next to the door. They could kick a door in. They could climb to the second level and open a window. They're not at all likely to pick my lock, though.
I advocate for using a decent consumer lock (i.e. not Kwikset - Schlage is sufficient IMO) with a properly installed deadbolt and strike plate but no further for most people.