Is the first more fallible because it’s quantified? Otherwise isn’t it easier to falsify a “powerful security feature” as it could be neither powerful or security related. Whereas a “bad” request is much less specific and thus harder to disprove?