Comment by arthur_debert

You're 100% right. It's just that security is so hard to get right. Only (maybe not even) the paranoid survive on that front. All it takes is one tiny detail to screw everything up. Leaving development artifacts on your live server is not very tranquilizing on that front.