If you don't assume your user/dev workstations are insecure, you're going to have a rough time in life.

I'm pretty confident in saying that 95% of companies have worse endpoint protection, local network protection, cloud protection, or the intersection of any two or three of those things than Slack does application protection. Maybe more than 95%.