That’s my point really, none of this is security, it’s security theatre at best giving the false impression of security where none exists.
It would be better to tackle attitudes to that, than create a facade of security - because if there is an incident where data gets out none of the above is going to protect you from being implicated.