It's true for a lot of cases.

Adding almost any restriction only hurts casual users, and attackers are rarely casual users.