Color me skeptical that IP whitelists are just about control and safety. Sure, they lock down access to certain IPs, but in the real world where I gotta switch IPs constantly for PBNs, it feels like the biggest pain in the ass. User:pass might be less secure if you don't manage creds right, but...