If you asked your CISO about securing your system against hackers and their response was "If they can't do honest pen testing, they should leave IT and go work somewhere else." what would your feelings be? OP wasn't trying to justify bad actors, but explain how the system is selecting for them, and we have to accept that our system is running in a world where there will always be back actors present. Systems must be built to be resistant to them.