Aren't most (non-insider) data breaches the result of OWASP top 10 things though? If the goal of security is to make sure the costs of stealing an asset exceed

Aren't most (non-insider) data breaches the result of OWASP top 10 things though? If the goal of security is to make sure the costs of stealing an asset exceed the value of that asset, then ensuring that the least-expensive-to-exploit vulnerabilities have been mitigated first seems like a good place to start. The fact that there may be other vulnerabilities that are just as dangerous doesn't mean it's equally bad to have vulnerabilities like that, if they require more time and sophistication to exploit. E.g. you shouldn't have string comparison timing vulnerabilities in your code, but having them is less bad than a SQL injection attack even if they can both lead to the same result.