The amount of security required will be different for different implementations. A system at the bottom of a secure mine that will never be connected to the rest of the world will not have to be secured with
remote attackers in mind. Physical plant security is a big part of system security, but we can’t assume that it’s enough. Relying on security through a single point, or relying on security through obscurity, is not enough.