- We shouldn't bother checking for characteristics of credit card fraud at transaction time, because a determined attacker might get a fraudulent card through.
- We shouldn't bother checking IDs at bars, because a determined attacker might get a fake ID through.
- We shouldn't bother trying to prevent email spam, because a determined attacker might get a spam message through.
- We shouldn't bother making laws against recording people without their consent, because a determined attacker might do so anyways.
Please construct a more plausible argument than "it's ultimately hopeless". I'm willing to consider alternatives, but I'm not willing to consider fatalism.