This is clearly needed. This should increase the maturity of the security practice around Fediverse software.

It's indeed a vicious circle. Also it seems easy to fall into this particular trap, I see it in many places.

Good approach to detect problems early and manage the risks they'll bear.