What's best practice for slice security - Start wide open and gradually restrict or start restricted and gradually open?

there's some pretty good info on slice security in the consulting training class. I pulled this screenshot from one of the slides in the deck. For account and entity slice security, its recommended to start wide open and gradually restrict. For the UD's it's recommended to start restricted and gradually increase access.