"These days, the company takes security extremely seriously. I think you'd be hard-pressed to find many nation states that have as sophisticated a security approach as Amazon does." Sounds like PR fluff. Maybe the crappy nation states have poorer posture, but decent nation states tend to have decent knowledge of security principles, decent isolation of data and tenants within networks, various physically enforced uni…
I think it's intentional. The client doesn't really care about security, just the perception of security. That's why the lvl 3/5 stuff works. They can look at a 53' trailer and a guy with a handgun and it _looks_ more secure than a scp script or whatever. It's also harder to to be fired when you look like you covered your bases, as opposed to fucking up some shell command and sending your whole db to the trash.