In version 1.0 we restricted full featured profiles not supporting security to "appropriate only for small devices with limited resources, including the inability to include a security infrastructure."
Now we have two out of the four full-featured profiles (ignoring the GDS profiles) not requiring security and only stating "intended for chip level devices with limited resources". This allows, from my understanding, that every OPC UA application can claim to support those profiles, even if they run for example on a PC, and become certified OPC UA products without supporting any security.
I think we should change the profiles to either stating that they can only be used when no security can be supported or select a security profile for them and change the wording that those are not required when security cannot be supported.
Otherwise, the claim to have security built-in OPC UA is rather weak.