Zero-trust collapses when email whitelists create permanent exceptions. Here's why this hidden risk undermines modern security investments.