Yes, I'm saying that it is completely possible that the risk assessment could say that the damages of an attack like this are ultimately less expensive than the

Yes, I'm saying that it is completely possible that the risk assessment could say that the damages of an attack like this are ultimately less expensive than the cost of mitigating them when probabilities are accounted for. I don't know that that's true, but I don't know that it is untrue either, because nobody is talking about the risk assessment math, most especially people calling for massive infosec increases.