If the requirement causes a massive security hole, the lawyers will probably tell you that knowingly allowing a security hole from a liability perspective is worse than turning off something an audit will flag.