It's a major factor. End user applications and behavior are like a house above ground. However security also depends on the foundation, that's the OS and hard

It's a major factor. End user applications and behavior are like a house above ground. However security also depends on the foundation, that's the OS and hardware beneath. If those are poor then there's no hope for stability.