A lot of the old intuition here comes from redundancy folklore, if one filter is good then two independent filters should be better, and the whole product bound story quietly assumes the failures don't line up. Once the layers share the same prompt semantics and the same model family, correlated misses are almost inevitable. So the real question becomes how much diversity you can buy before the extra latency and cost stop paying for themselves.

"product bound lies" is the polite version of saying the layers are all reading the same mail. Seven defenses that share failure modes mostly give you seven places to pay latency for one mistake.

do the access tiers just turn into a fancy rate limiter, or is there something in there that actually changes the failure shape? the correlation result makes me suspicious of any stacked setup anyway