I had a mentor at my last job who would repeatedly say "You can't test safety into a product." As in you have to actually do the work to understand and limit how the product behaves, and only then can you call it safe. If you build a product without thinking of safety, then try to test the safety into the finished product, you just end up covering all the known sharp edges with foam. Software products have limitless sharp edges.