Except that most risks are from bad leadership decisions. Exhibit A: patches exist for so many vulnerabilities that remain unpatched because of bad business decisions.
I think in a theoretical sense, she is correct. However, in practice things are much different.
I'm a bit surprised to see a permanent Arkansas license plate on it. There's a better chance of it having an expired temp tag.