Can you help me understand the costs? Because as far as I can tell it is:

1) "We should consider using Allowlist" "ok, but let's be careful with externally facing APIs, in exactly the same way we change all our externally facing APIs?" "Sure!"

2) "I was editing this file, find/replaced a couple cases of whitelist while I was in there" "LGTM"

3) "Oh, hey, noticed we had nearly finished opportunistically replacing whitelist. Does anyone mind if I just finish up?" "Sure, timebox it?"

Like, it's extremely low cost? What costs are you imagining?