The things you're saying make it sound like you are harming clients by misrepresenting security to them.

Security has to start from "when", not "if", precisely because it is fundamentally impossible to guarantee.