I would argue for anything security - if there is a difference between how it works in theory vs in practice - then the theory is flawed. Physics gets to have theory/practice distinctions, but engineering doesn't because the bridge can't fall down.
In Physics, if a theory doesn't describe reality, the theory is incomplete. Of course all theories are ultimately incomplete, the goal is to find theories that match reality better than the ones before.
Exactly, and it's a very real problem with the IETF-way of building things, and why "this is what Chrome does, copy it" becomes the real standard.