The problem in claiming "the evidence says..." in cases like this is that the body of potential perpetrators is intelligent and adaptive.

Say someone cracks a major bank account by guessing "password" as the password. The bank changes the password.

I claim that the weak password was a security risk, and changing it was the right response.

Someone comes a long and gives me a data-intense lecture about "well, electronic bank theft was already declining, and it accounts for only a tiny fraction of financial losses, so changing the password was a waste of time, and was in the context of the IT department using a bunch of pretexts to order people around".

How would you refute that, given all the evidence on their side?