I think this has historically been true and is still approximately true now. But I think in the relatively near future (less than 5 years) there's a really good chance it won't be true anymore.

Once open models catch up to the current frontier in vulnerability exploitation, the cost to target people will go way down. In the past, the cost to hack a random individual person was generally high enough that if there wasn't some special reason to hack you in particular, it wasn't worth it. That may no longer be the case in the near future. The floor of what is acceptable security for the General Public probably needs to rise quite a bit over the next few years.