Rational Inattention and a Causal Account of Program Security