`isUserAGoat` ended up allowing any caller to determine if a specific app is installed on the system, which is a privacy violation and allows fingerprinting against the user's consent.

I get the desire to make the job more fun than just implementing a spec, but many of the things we work on are very important and very complex, with oodles of real-world consequences. That unfortunately means everything we do has to be well-considered and not off-the-cuff.