It can be both at the same time. A government won't be great at protecting its citizens if it has no power over bad actors, both inside and outside.

Your first sentence seems like a distraction because the same criticism of NOBUS holds either way. Even if the leaders do not care about the citizens except as a means to an end, an oppressive government especially needs to maintain security because it needs to project force to deter threats to its power. If they have a known vulnerability, they should be even more worried that internal dissidents or an external foe will find it because they are even more dependent on power in the absence of democratic legitimacy.