You seem to be captured by the “all or nothing” security fallacy, when security must be viewed through the lens of (probability) x (impact)