A third party s/w crashed because users failed to validate deployments. So from MS perspective users can't be trusted and need to be further locked down.