You're right, and there's a nuance. You absolutely have to deal with tactical threats, but be careful not to go from threat to threat, because there'll always be

I've seen businesses, especially software, do this where 99% of the company's effort was in "doing the right thing" by supporting their last product so much they were never able to put any effort into a better product. Getting out of this is where the right CEO earns their pay.