Why a product-first approach can put security and reliability at risk