Most threat modeling advice is written for companies with a security team. If you are six engineers shipping a product, that advice reads as a list of reasons not to start. STRIDE per data flow diagram element. Trust boundary enumeration. A DFD maintained as the architecture changes. Attack trees. It is all legitimate, and none of it survives contact with a team where the person who would run it is also on call this week. So teams do the honest thing and skip it, and then the security ques...