Are you redefinig the field of information security? Please read some basic material on information risk and security.

I mean,even just reading vulnerability bulletins and CVE descriptions should familiarize you with explotability and complexity of attack,they exist to help remediators prioritize more insecure vulns.

Quick example: 'ls' has an easily exploitable code execution vuln. On a shared terminal server,this vuln translates to severe loss of security. On a firewall,this is nothing more than a house keeping item with no real loss of security as there are no threats that can run 'ls'.

You are moving the goal posts. The issue I take is with "threat actor". If a threat actor wasn't detected you have no idea if they exist. Only windows crapware tries to make the warped perception that what it doesn't know doesn't exist and priority obviously goes to where exploits provably exist. But insecurity is being attackable not being aware you are attackable (and certainly not knowing you are attackable but seeing no frequency of attacks).

Would you want your electric company to use these products knowing that another country will attack with 0 frequency until war is declared?

Look,the concept is not subjective. I didn't say a threat actor,I said threat.

I highly recommend looking these things up on your own but the goal of Information security is to reduce the risk that vulnerabilities will be exploited to where a breach of your security goals occurs(i.e.:CIA triad,confidentiality,integrity and availability mostly). It's not to make your system impregnable to all conceivable attacks.

My electric company should have well resourced nation state actors as part of their threat model. They should not only remediate known vulns,they should also employ EDR solutions that perform ML and behavioral detections/preventions. They should be part of their industry ISAC for threat intel sharing (which includes 0days) as well as have a comprehensive threat hunting and incident response program. Your average consumer,howevet has different types of data and attackers to worry about.

A banking trojan cleaning out your account,ransomware demanding payment for your family pictures, an ex installing RATs to monitor what you do are what consumers are threatened with.

Being attackable is not insecurity Right now you're attackable by an endless list of threats. Your local gang,serial killers,crazy people who shoot up schools,terrorists,etc... But your security is measured by a number of factors including where you live,what you're doing and specific attacker's cost-benefit analysis of attacking you.

Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brought up threat actors.

Ok,better analogy:There's a 0day vulnerability in a specific device driver you happen to be using,crafting a workable exploit requires a significant amount of skill and the exploit can only work under specific configurations. A well organized and talent-resourced attacker performing targeted attacks would exploit the vulnerability. Realistically,you'll have to take into account the likelihood of someone exploiting this vulnerability when prioritizing remediation(grading insecurity).

A simpler example: apache2 has a RCE but known exploits require PIE disabled for an exploit to work. You have one apache server in a segregated vlan that is facing your admin vlan with PIE enabled. In contrast you have an IIS server with DOS vuln facing the internet. The IIS server is more insecure because there is a significantly higher likelihood of a security compromise(availability) against it and the org will face reputational and revenue(?) Impact.

The whole point I want youbto get is that real (in)security is context aware.