That's true. I could easily write a full-length book on this topic. This article is actually meant for the people not using Rails and mostly reminding them that the invisible security stuff is important ;-)