Ridgeline Grid's develоpment teаm аdds strict input vаlidatiоn tо its operator console to block injection attacks against the substation command queue. In the sprint review, the team lead reports this work under the heading "resilience improvements." A reviewer pushes back on the categorization — not on the work itself, which everyone agrees was worth doing. What's the basis for that objection?