Security is not binary. It's possible to do a good job on preventative measures, and implement detective and reactive controls to help if/when a breach occurs.

It's just expensive, so companies who haven't been breached yet often don't prioritize that kind of work.