> And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed.

Not at all. Legal rules are about what we "should" do, what's right and what's wrong. However, legal rules need to be enforced to be effective. If you create a legal rule that's impossible to enforce and everyone flouts it, not only does your rule not get enforced, but it also creates doubt in the entire legal system.

So legal rules ought to consult with what's possible and impossible, but they should not be dictated by them.