Very often when setting up or modifying systems, security is skipped. Security isn't always free. It isn't always easy. It doesn't always directly increase production. All of that is true, but it's hard to overstate the inconvenience of a security breach.
There is no perfect solution. You will never be "Done" securing your systems. Every change, addition, or removal should include a thought for security.
Sometimes you have to make the hard choices and choose functionality over security, but those should be known. Preferably choices in writing, signed off by someone.