Not sure what you're proposing here.

The fact remains that if you don't lock systems down then bad actors WILL take advantage of them. That's a given. But if you do lock them down then, maybe, future bad actors COULD take advantage of that fact?

IOW, you're balancing a certainty against a possibility.

Cyber security has and always will be an arms race, and one of the core issues has always been: who do you trust?