I fully understand that. It was intended to be an analogy. Let me try again. A decade ago, clueless sysadmins put unpatched servers directly on the Internet

I fully understand that. It was intended to be an analogy. Let me try again. A decade ago, clueless sysadmins put unpatched servers directly on the Internet with no firewall protecting ports that didn't need to be exposed, with no hardening, no patching, etc. An hour later, after their shiny new server got rooted, the clueless sysadmins stood there with the classic deer-headlights look, wondering what just happened. Today, with OS's that have reasonable default configs on as-shipped, and with firewalls the norm, it's the application developers that are clueless id10t's standing around with the deer-headlights look.