"We are bad at this job, but we don't do it often so don't think we are bad at other jobs".

Yeah, the proportion if anything is too small. This is the sort of company that should not be doing anything related to security.