the implicit argument you're making here is that the only acceptable security risk mitigation strategy is one that works 100% of the time

See the source code and interacting with it running is different.

every system has an attack surface. If you make yours easier for any person to use "alternative" paths, I also got some bad news for you.