This is full of very serious answers. I thought this was a rhetorical question to highlight the tendency of software developers to mismanage risk.

I feel like no matter what the answer is, the questioner could just throw another "But what if..." on top of it.

Set a post-it note saying "Water here". But what if a Black Hat gains access to the coffee machine and moves the sign? Etc. You can't win unless you know what the questioner wanted to hear. I guess that makes it a good interview question.