Security you can't justify is a vicious cycle

Dependabot is on fire, the model yells, the meeting says add TLS. Fine. Is this stopping an attacker, or feeding a checklist?