> There's a massive cost asymmetry between the "hardening" phase for the defender and the "discovering exploits" phase for the attacker.

Well, you need to harden everything, the attacker only needs to find one or at most a handful of exploits.