> Hopes and prayers do not make a valid security strategy

It’s not “hopes and prayers” to actively decide a particular attack vector is unlikely enough that the the costs and risks are not worth it.

My local cafes and bars do not employ bouncers, but the local concert venues and nightclubs do.

All these places want to keep out outside food and drink and avoid violence among patrons. The local cafes and bars decided it’s not worth having a bouncer for that. That’s a valid decision.