Risk analysis is typically done including both the probability of a problem and the impact of the problem. Not including the former in an analysis will result i

Risk analysis is typically done including both the probability of a problem and the impact of the problem. Not including the former in an analysis will result in spending vastly disproportionate amounts of effort on exceedingly rare problems, e.g. the consequences of a 1000ft tsunami hitting New York would be huge, but we don't build massive sea walls because it is also ridiculously unlikely. This applies perfectly well to digital security too: reducing the probability of an exploit is just as important as limiting impact if it does happen, which is why (for instance) Mozilla is doing both.