The problem is that as long as there are attackers willing to spend resources, there is no limit to spending money on security, it is adversarial. At some point

The problem is that as long as there are attackers willing to spend resources, there is no limit to spending money on security, it is adversarial. At some point, security will cost more than what you are securing, and that's when people drop the ball and prefer to deal with the consequences. Same ideas as with bicycles. Thieves now have sufficiently advanced tools that people stop buying the kind locks that could possibly stop them, and instead just assume that left unattended in the outside, their bike will be stolen eventually, and deal with it. For example by not having nice bikes, or by not biking unless there is a safe place for that bike. So yeah, leaks will happen. Unless maybe you get a combination of well designed and enforced security standards, harsh penalties for cybercrime, and international collaboration.