You tend to only hear about the systems where security was successfully broken, not the systems nobody managed to penetrate.

The thing about bullet proof is that nothing is bulletproof when you have a big or fast enough bullet

Yes, but what is meant, that it provides protection against common calibers. So you can have bullet proof security in IT. That does not mean it is blast proof, or acid resistant, or prevents someone using a backup key on the second entrance. It is just a metapher saying this security is very solid. Might be true, or not, but that nothing is 100% secure is quite known.