You are not being interviewed as a security engineer. You are being checked for one habit: whether, while describing a system, you notice who could abuse it. Security questions rarely arrive labelled.
Source: [Dev.to](https://dev.to/moputa/security-questions-every-senior-backend-engineer-should-handle-2n3g)