Depends. Security is and never was only bug free software.
If no attacker reaches system X you are not as exposed as with your internet facing frontend.
If no attacker reaches system X you are not as exposed as with your internet facing frontend.
But, and it's a big but.
Each layer must be made as security as possible or one flaw can lead to all the layers below it collapsing.
Not reaching system X is just security by obscurity. People have learned the hardware just because something isn't directly connected to the internet that doesn't mean attackers can't reach it. For example clever data poisoning attacks can reach deep into organizations and breach systems you'd never expect.