I’ve had very expensive pen testers tell me to do this as recently as last year. They folded instantly at the first sign of pushback, so it seemed to me something that had been sitting in a checklist for years without anybody questioning it, making every website and app they audited worse.