In my experience, the proper infosec professionals both know and balance this well, it's the amateurs and posers who gets it wrong.