It’s the classic asymmetric warfare problem:

Defenders have to find all the holes in all their systems, while attackers just need to find one hole in one system.

A slight factor differentiating security systems here is involved to the advantage of defenders: Attackers have to find a whole exploit chain, while defenders only need to fix one part of it.