That they have not made available a threat model is the kicker for me. Every time people start talking about security, whether it's their email or their house, inevitably they start going nuts with all the possibilities. They then leave real security against real threats at the door in order to deal with imagined ones that require far greater resources to secure against. I'd bet that many fortunes were made by security 'professionals' catering to these whims.
The threat model is the antidote to this tomfoolery. Before you even start to touch a primitive, sit down and think very hard about who you're trying to be secure against and what their available options for attacking you are. Then write this analysis down and make it a living document, referring to it constantly to make sure that what you're writing is actually protecting you from something and what and how it's doing that.
I'd go so far as to say that without such a document, a system cannot possibly be secure because it doesn't know what it's doing. What's more, the poor team in charge of maintaining and updating it is going to be forever behind the curve, reduced to putting out fires whenever they pop up, be it from external actors actually breaking their code or from their own ignorance introducing vulnerabilities that weren't there before because their updates didn't take into account the non-existent threat model.