Can't have a bug in a feature you never implemented and can't have another arising from unexpected interaction of two features you didn't implement.

It's the one security practice that actuuuualy works