Good faith users don't need security policies because the security policies weren't written for them. They were written for the pathological cases.

Good faith citizens don't need laws because the laws weren't written for them, etc.

Systems designed around the pathological cases help keep those pathological cases at bay. They are a framework for allowing the good-faith people to continue to act in good faith without having to constantly worry about the pathological cases themselves. I'd love to go back to the days when people left their doors unlocked and no one had a password to get into their account, but those days are gone. So are the days of not having a code of conduct on your open source project.