It's true, but I tend to think humans are pretty bad at threat evaluation if the threat lasts for years and years.

Kind of like the IT admin that doesn't check backup integrity often enough because there's never been a data loss issue in years.