Completely agreed. Focus on what you know to be an exposure (ie publicly accessible ports) versus what you are guessing might be an exposure. To put another way, fix what you know to be broken.