Fair, I totally neglected to recognize that's what you were here for and focused entirely on trying to get the concept across. I don't usually pay much attention to which community I'm reading, I just stick to local for tech stuff and all for everything else. I barely customize the experience at all.

I'm not a security-specific person but I am a programmer, so I will just pass on one tiny nugget of wisdom on the original topic: Yes, what bothers you about the messaging in the UI is possible without compromising security, it's just more complicated and requires a bit more scrutiny and due diligence on the part of the engineering team. However, "possible" and "reasonable" are two very different things in the eyes of a developer. We are typically constrained by tight deadlines, moving targets, and competing priorities, and that often leads to doing the simplest thing that solves the problem now, rather than the elegant and full-featured thing that will make everyone happy. My favorite reference on this topic is SMOP, (Small Matter of Programming) which is basically the idea that I just spelled out. Yes, what you want is possible, but it is more difficult than most people realize to do right.