Counter point: Anything that changes the profile of the attack surface and presents an opportunity for detection can be considered a security boundary. Some may be more effective than others, some may have bugs, others may be configured badly but they all have some boundary value. The point of a security test is to point out the bugs and misconfigurations.