Security is a process, not a product.
It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.