Yes, it’s insane. Step 2 does next to nothing for security without step 3.