[htrp]

Attackers only have to be successful once while defenders have to be successful all the time?

[citrin_ru]

Yes and no. Good defence is layered and an attacker needs to find a hole in each layer. Even if it is not layered intentionally a locally exploitable vulnerability gives little if you have no access to a remote system. But some asymmetry does exist.