Not always. A few years ago, I demonstrated for a business owner a simple set of breaks to his website that allowed me to download, install, and execute code on his server and then use it to look and and download every file on the system. He understood that his source code (the "crown jewels" as he called it) was therefore vulnerable, but never did anything about it.