If a global security is defined, it will be applied to every endpoint. The global security should be allowed to be overridden at operation level.
Thanks @joni3k for this. I was planning to do it myself.