There is a saying "If someone can make it, someone can break it" This applies to physical security also. There are way too many attack vectors for you to plug

There is a saying "If someone can make it, someone can break it" This applies to physical security also. There are way too many attack vectors for you to plug every possible hole. 20 years ago do you think anyone was considering that you could determine the contents of memory otherwise inaccessible your process just by reading the memory accessible to you in certain manners (Rowhammer, [1]) Or that a device taped under your desk could read your encryption keys right out of the air? [2][3] Or that an attacker could intentionally cause errors by overclocking/undervolting "glitching" your device to cause it to skip certain instructions in order to gain access to it? [4][5][6] Or that exploiting flaws in the way a CPU tries to predict the next instructions could lead to privileged information leakage? [7] A sibling commenter hit the nail on the head. You have a large surface area to protect. They only need to find one tiny crack. But by far the most common vulnerabilities are simply someone not properly validating input[8][9][10]<-(a ton of specific attack incidents listed here), or not allocating memory properly [11] [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://www.theregister.co.uk/2015/06/20/tempest_radioshack/ https://www.theregister.co.uk/2015/06/20/tempest_radioshack/ [3] https://www.tau.ac.il/~tromer/radioexp/ https://www.tau.ac.il/~tromer/radioexp/ [4] https://toothless.co/blog/bootloader-bypass-part1/ https://toothless.co/blog/bootloader-bypass-part1/ [5] https://av.tib.eu/media/32392 https://av.tib.eu/media/32392 [6] https://www.multichannel.com/news/black-sunday-fix-dbs-pirates-132341 https://www.multichannel.com/news/black-sunday-fix-dbs-pirat... [7] https://www.wired.com/story/foreshadow-intel-secure-enclave-vulnerability/ https://www.wired.com/story/foreshadow-intel-secure-enclave-... [8] https://www.pcworld.com/article/148007/security.html https://www.pcworld.com/article/148007/security.html [9] https://blog.detectify.com/2016/04/06/owasp-top-10-injection/ https://blog.detectify.com/2016/04/06/owasp-top-10-injection... [10] https://codecurmudgeon.com/wp/sql-injection-hall-of-shame/ https://codecurmudgeon.com/wp/sql-injection-hall-of-shame/ [11] https://engineering.purdue.edu/ResearchGroups/SmashGuard/BoF.html https://engineering.purdue.edu/ResearchGroups/SmashGuard/BoF...