Sometimes organizations that look less secure are actually more secure just because they degrade gracefully under attack and/or can more easily mitigate/revert the consequences of successful attacks.