> that if security costs 10x to defend and 1x to perpetrate, then the system will by definition fail)

That's only if you have an infinite supply of evil doers. The cost in operational experience and manpower can deplete the number of operatives that can pull off a complicated attack.