This is exactly right. There's also the underlying asymmetry; defenders need to get everything right, attackers only need one vulnerability. (Which is usually human behavior based.)