It doesn't even need malicious intent. If nobody rational is monitoring it, all it will take is a bad datapoint or hallucination for your door to get kicked in by mistake.
To quote the standard observability conference line "what gets measured gets managed".