You're one mistake away from losing everything. That's not security. That's just risk transfer. Real security doesn't put all the liability on the user.