Both can be true: people get hacked because of lax security, but "security" is often used as a vector to enshitification.