It is absolutely bonkers how many otherwise pretty reasonable people miss this glaringly obvious fact.
If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success.
However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.
“By your logic I could claim that this rock keeps tigers away.”
“Oh, how does it work?”
“It doesn’t work.”
“Uh-huh.”
“It’s just a stupid rock.”
“Uh-huh.”
“But I don’t see any tigers around, do you?”
“Lisa, I want to buy your rock.”
Anyone with clean floors should fire their janitors.
Etc...
Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.
Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?