Security and "package" application software

["Dave Odom" <Dave.Odom@xxxxxxxxxxxx>]

Is the following normal for i5 "package" vendors:

You buy and install a vendor's applications and, while they have an
internal security mechanism for allowing users to each and every piece
of their application, there is NO SECURITY on the files of the vendor's
applications if any user has command line access, Query access, ODBC,
FTP, etc.   Is this normal in the i5 world that a vendor would leave you
"open Kimono"  when comes to back doors?

I understood that reputable vendor's created their software such that
all files were MAYBE READ ONLY to end users and all access to change
data was via the application's authority and the application gained
those authorities during installation using a userid like QSECOFR or
QPGMR or other designated user with special privileges to objects.

What am I missing about the i5 world and its typical application vendor
and their development methodologies?

Thanks in advance,

Dave