> instead of making a threat model

because they want the threat model to be "what any customer who is going to buy this shit might have as a threat".