Yep, complexity, the false sense of security you get from an inflated judgement of what it gives you, and the 'opportunity cost' of time you spent devising, implementing, and dealing with it instead of some actual secure protection.