Less is more: usefulness of data flow diagrams and large language models for security threat validation (EMSE, 2026)