Are we reducing research security risk, or just shifting it around?

Summary

Are current research security frameworks genuinely reducing risk, or merely redistributing it across borders?