The mental shift

Your app has two kinds of users. You designed for one.

Every feature you build for legitimate users is simultaneously an interface for attackers. Security is the discipline of designing for the second audience too.