Second, they are only doing their job according to their training. You need to help them learn security for the real world. Of course, if they are not open to learning, escalate, armed with real data. Lawyers Lawyers also have idiot teachers. Why else would they reduce a web site to total unusability with agreements, warnings, threats, and special Java extensions that send 440 volts through the keyboard of any hapless user who has the temerity to actually use your site.
Lawyers can screw up a web site more effectively, more thoroughly than any other handler.
My experience has been that there is no more point in arguing with a lawyer than debating a ferret. If you have a lawyer reducing your site to Latin derivatives and upper-case sludge, prove the damages through user testing, surveys, and web site logs, then escalate the written result all the way to upper management. The folks at the top understand the bottom line. They can, and will, do something about it. A lot of my readers and a lot of my friends are graphic designers, so I want to tread lightly here.