So to sidestep this issue, a developer could provide a product configured to be completely locked down with little to no access to network/filesystem/kernel and provide a blurb as to being completely secure with the "recommended" configuration. Any configuration opening up access would be considered to be at the users own risk.