https://en.wikipedia.org/wiki/Parable_of_the_broken_window
Basically, if you accept this line of reasoning, then someone going around breaking windows and someone else going around repairing them can be seen as good because it creates jobs. But that would be nonsensical and create poverty. That's why economists focus on wealth creation not job creation.
Fixing security bugs is only needed because people exploit them. It creates work but it doesn't create wealth.
Protecting yourself from bad actors also doesn't create wealth but it protects wealth you already have.
You know cybercrime and APT groups are not bored kids in their parents basement, there are groups that are running automated tooling to find vulnerable companies and if possible take all their wealth.
Just look at Binance of course, but if you are small company there are also people targeting those especially with AI assistance nowadays.
it is distinct from question whether it is productive to defend from evil people
evil people + protecting from them is obviously net negative!
but it is not changing that of evil people are present then reasonable level of protection from them is needed, and setting it up is productive