> When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.

No you don't. You definitely don't want to assume otherwise and you spend the time derisking and investigating, but if you have zero evidence to support the situation you don't just consider it the case anyways.