Past performance is not indicative of future results.

It's easy to create a set that looks as if it was a real city. It's infinitely more hard to create that real city.

But you're absolutely right that a set is all it needs for all sorts of (cyber) attacks.