I'm not sure why there's so much negativity in this thread. The listed requirements were already basic table-stakes security standards. IMO, anyone not encrypting all user data at rest, requiring MFA, etc. is bush league.
That’ll end up in an arms race where you refine the gibberish to be more and more believable while the crawlers get better and better at detecting poison wells. The end state is where your fake pages are so close to the real thing that humans can’t tell the difference
That's true unless you get acquired. At that point, your title is what your new overlords will use to determine your role, salary, and even whether to lay you off.