If a vulnerability can exist with "layers of secure coding" and undermine the whole structure, why do we call them "layers?"
The billing hours work out better.