That’s like saying cars don’t need airbags because people should drive responsibly.

Edit: case study: Optus, who leaked pii due to an unauthenticated api intended for internal use only but accidentally exposed to the internet.