Threat modeling is half nonsense because it becomes an excuse for negligence, often by lazy professionals who are just collecting a paycheck. Would you for example do threat modeling to protect your Bitcoin wallet passphrase or would you just secure it?