> security is a binary (can an attacker gain access to information)

Only if you're looking through a very narrow lens.

There are a range of potential attackers out there with different motivations and resources available to them. The question you have to ask (for each attacker) is whether the value of the thing you are trying to secure is worth more to them than the cost it would take them to break your security.

In aggregate, that looks a lot like a spectrum of security, with different people being secure against more or fewer different attackers.

"The thing" you are trying to secure is either secure or it is not. That is what I meant by "binary".

"The thing" you are trying to keep private is either private or it is not, too.

Maybe you're saying that some information is more sensitive than others, which is true, but some security failures are worse than others (e.g. denial of service vs. remote code execution, or ability to forge messages vs. ability to decrypt messages).