Many devs downplay security practices when they think/know it can be defeated in one or more ways, but those practices are not a security theater.