Completely seriously, you and everyone else reading this need to not just "know" this, but believe it and feel it.
Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team.
Of course, where this metaphor breaks down is that these metaphorical lardasses will not be able to fail to notice them getting their asses handed to them, whereas in the security space, their real-world analogs may not even notice they were hacked.
It's brutal out there. Even the open source tooling is far more sophisticated that most people reading this realize, and that constitutes the baseline, not the top end. There's an underground economy, and it is sponsored by many entities with deep pockets, including large-scale criminal enterprises, some of which can rival "real" companies in scale, and government-backed operations of all sorts.
You're not up against a stray hacker bumbling into your system. If you've got assets worth anything, you're up against professional organizations. If you are responsible for anything that matters, take the threats seriously.