You're absolutely right, what I meant is that its not just about using the right algorithms and making sure they are implemented and used correctly. It's also a whole host of other things including avoiding SQL injection, CSRF, XSS, data leakage in logs, proper access and provisioning, following and reacting to the constant stream of security alerts (case in point: the MySQL Ubuntu issue that cropped up yesterday).