Agreed, but only if & when the abstractions are not "leaky". Robust encapsulation is simply not possible when abstractions are leaky or ill-fitting for the domain -- including an incomplete model of the domain. The latter point -- needing a complete & consistent model of the domain -- is IMHO commonly under-appreciated; a lot of software is based on poorly understood partial abstractions for their respective domains.

Bits of information leaking through faulty abstractions are exactly what make conduits for "side-channel" attacks.