That's exactly right - it's about risk. No one has "perfect" operations/ security. They have a threat model and a risk tolerance.