Or more closer to infosec, I think, is that I bought a house and it had 'cheap' locks that anyone with 10 minutes and a lockpick can open. Sure, maybe I should have considered some harder core stuff, but in the end thats what I have and what is practical for 100 good reasons. The same way corporate IT can only be so secure. So no one is really leaving the door open, its just with enough effort you can break any lock.

Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.