Second that - I assume that they did asnmuch as they could and this is just defense in depth one additional step.

That is not defence in depth, that is causing annoyance to web developers.

In my experience, that's probably not a good presumption anymore.

It feels to me like usability testing and quality assurance have both joined security and accessibility on the back burner now.