>Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?

Part of the way you design hack-proof security systems is by identifying the dumb ways of doing things and then not doing them.