You bring up an interesting security topic, if off-handedly.
Why on earth would you put an operator level security login on a local HMI when all the HOA switches, four feet or so away, don't have any security?
I see this all the time. There's a big wave of security concerns going on right now. There was another one after 9/11. Fly by night companies are being formed out of nowhere to address the supposed problem.
Similarly, there was a wave of companies that would research your control system for Y2K problems back in 1999.
The goal of these efforts seem to be to make a report for the owner so he dots his i's and crosses his t's for insurance and regulatory compliance reasons. Rarely, a specific problem, is identifies or solved.
The companies that do this are generally (i am being generous) clueless when comes to ICS's
No one on our side complains much because there's often a scrap of work involved. Just a little scrap. We don't stand up for ourselves very much, myself included.
I am not against security, but what I see here in the US is a lot of second world infrastruture where security should be at a lower prioritity than more rugged installations and well written software.
There's only so much money to spend, and IMHO, it's being directed at the wrong task.