That is a simplification of a complex issue that is so bad it becomes meaningless. It might make a nice bumper sticker, though.
Security has always been a balancing act that starts by understanding basic risk/reward scenarios used by the criminal mind. Being “secure” by definition is being at a place where the amount of effort to gun you is so high as to not be worth gunning you. This level is different for different installations and pretending it’s all the same is ridiculous.
A criminal seeks the largest payoff with the smallest effort. A cracker starts by running a bunch of canned scripts against as much of the Internet as they can access. Since this is all automated it’s minimal effort. Since the canned scripts are written by someone else and just picked up for free by the cracker, once more, minimal effort.
So if you don’t have anything worth stealing - like for example a FreePBX system that runs 6 extensions in your house, all you have worthy of theft is 1 CPU unit that could be used as part of a DDoS attack against someone else, or used as phishing against you. And the only protection against phishing is user education - teaching people not to be stupid in the digital age (No Grandma, you won’t get $5,000 if you send the nice man $50) The tightest and best security can be defeated by stupidity of the person using it.
The cracker isn’t going to spend 100 hours breaking into your system to obtain that 1 CPU unit because there’s always going to be someone else on the Internet with a system that requires far less effort to break into. In fact, the cracker is very likely going to come up with so much low hanging fruit from his canned script that he didn’t write, that can simply be automatedly broken into, that if your low-value FreePBX system is secured against all known canned scripts - you are, by definition, “secure” Because, you will never be cracked since the effort isn’t worth gunning you. So you are perfectly “secure” when you treat security as an afterthought.
However, if you are for example a bank, government, or other large org that has significant amounts of “stuff” worth stealing - that cracker may not only spend 100 hours focused on your systems once he finds them (which is trivially easy to do in most cases) trying to break into them - he’s going to likely use “off book” methods - custom written attacks (assuming he knows his cracker trade and isn’t just a wannabe) to attempt to break into them.
So a single individual only needs to keep current on the latest security patches - or completely isolate his system from the Internet - or otherwise take minimal security precautions, while a bank needs to do that plus a whole lot of other stuff. All the single individual needs to do is be “more secure” than someone else. But the bank needs to be “secure” that is, which for a bank is likely technically impossible because the payoff of breaking into a bank is so incredibly high that people will spend an almost unlimited amount of time and effort trying to break into them. And the fact is - we still read about bank robberies happening even today -and infosec cracks of them. A bank most definitely cannot treat security as an afterthought.
People react to security threats as they become known. For example at one time we had these things called indoor malls that were popular. These fell out of favor and got replaced by stripmalls. However, stores in stripmalls are insecure when it comes to smash-and-grab thefts. Thief steals a car, drives it into the glass front of the store at night, runs in, steals tv sets or whatever, runs (or drives) off with an accomplice. So stripmall stores started reacting by putting up concrete barriers (why do you think Target has all those red concrete balls out front?)
Stores realized that increasing security makes the store harder to access and more unfriendly and difficult to access, so competition forces them to strike a balance between security and ease of use.
Software makes the exact same balancing between security and ease of use. But that balance is different for different installations. A bank’s FreePBX system has to be harder to access online than your home FreePBX system - so it’s wrong to make a blanket statement like you did and assume that it’s the right thing for a FreePBX system used in your home to be as difficult to use as a FreePBX system in a bank.
as 
This is a process that the project has lacked for several months and surely many can find at least some satisfaction with this recent improvement.