How things are in practice matters, but there's risk that you're misreading the situation. Theory can speak not just to how you think it is, but also to how it might be - particularly in security, where hostile actors are trying to change how it is.