True. Those who only care about meeting regulatory requirements are not going to care if the regulatory requirements cease to exist. Those who care about security may be dismissive of regulatory requirements, but they will do so primarily when they are insufficient or when they conflict with their opinion. In the former case, they probably have the ability to go beyond the regulatory requirements. In the latter case: while I won't claim that regulations are perfect, I would trust them over the an anonymous person who may be going on anything from their personal opinion to legitimate research.