To add to this, there is a time component as well. If your data only needs to be secure for 20 years, it has a different threat profile than one that needs to be secure for 200 years. Then the question becomes "20 years for who?". The safe industry, as an example, thinks about their security problems in this manner.