There is security that protects users and then there is security theater that provides litigation protection for the company.

Sometimes overlapping, but they are not the same thing.

Both are important actually, the security theater often deter from trying because it could be too annoying, it's generally "free to do", along with additional obfuscation, it's useful too but does not replace proper security, but from experience, theater+obfuscation+security is greater security than just security.