i'm saying that it's an elephant in the room - free speech is fine but a reasonable layer of protection against access to privileged data - we here see a prisoner's dilemma that nobody wants to take the cost (a few days effort) to solve, which is abombinable 

 I think this won't change, until more people use SDKs.  Everyone will just build the absolute minimum they need. The correct model is for them to only implement the minimum they need from the core library.