Yeah, doing the basics well works better. But security theater is better PR, because a lot of people believe that if it's making you miserable, it must be really effective.