Sadder reality: This principal has been extended by many CEOs to justify not doing any security. The OP speaks of the costs of running a top-notch system. That's expensive. But please do something. Something more than just relying on your head of IT and your web designer. Read the Ashley-madison report by the canadian privacy commissioner. A supposed unicorn and they were doing nothing.