I get the desire to have a parsimonious system, but if you take these two axioms in vacuo, then you've nullified cyber security law[1]. Or in other words, if you didn't want to get hacked, you shouldn't have had any exploits.

Maybe this is what you're going for? If not, you'll need more or different axioms.

1. 18 U.S. Code § 1030 - "access[ing] a computer without authorization or exceeding authorized access" https://www.law.cornell.edu/uscode/text/18/1030