If we look at things realistically you are in fact correct, some companies have good layered security but for most security stinks and most of the measures they take are inefficient or not even working at all, this makes for fun discussions when I work for one of these companies as a consultant :-)