Seemingly secure everyday components like streaming devices and authentication flows are central attack vectors when no explicit threat modeling has taken place.