All security is a negotiation of allocating resources. It always ends with “well, that’s good enough for this.” There is never a “Ahhhh we’re done!” It can always be “more secure”.