Security Best Practice: Disable if already not visible?

Should I bother to disable an element for a particular User permission type if it is already not visible?
Is this over-engineering, belt and suspenders?
Does it slow things down?
Is it worth the added protection for sensitive info/action?

Short answer: Yes.
Long answer: Yes. It doesn’t hurt.

1 Like

thanks