Exactly this. we try to prevent cyberattacks as much as we can, but at a certain point, they're impossible to perfectly defend against without also totally locking down our users and making it impossible for them to do their jobs. so then the game becomes one of containing the amount of damage an attack can do.
Security is restriction. our job is to balance our users' ability to perform their jobs with acceptable levels of risk.
I always imagined that it was due to a higher level of computer literacy amongst the consumer population. An hour after a corpo releases a new piece of tech under a subscription model, the software has been cracked and pirated all over the net.