There's another argument that might work in GP's case. A fair share of successful attacks were successful not because the attackers actually broke something on their well-guarded target. But because they used credentials obtained from other poorly defended systems.