However, this only helps if you're a typical desktop user whose primary threat is a random virus or other malware attack. If you're like Google, on the other hand, you have to worry about highly developed targeted attacks -- to stretch the analogy, a large bear that has specifically picked you out of the crowd.

When that's the case, all the random scattershot viruses in the world become irrelevant, and your platform's inherent security mechanisms and development practices are the only things that matter.

Sure, as a home user. Not if you're guarding against well-funded hackers looking, specifically, to steal your documents.

That may be "all it takes" for J. Random Hacker worried about his personal system being compromised. But when it comes to a large corporation with a metric shit-wad of extremely sensitive and potentially very sought after data finding themselves in the digital targeting reticule of hostile corporations and even the intelligence services of first world governments that level of "security" is about as useful as a bullet-proof vest made of single ply toilet paper.