Imposing government-regulated security requirements on software companies may go too far and create unintended consequences.