Fallacy applies only to incidental breaking of glass like child smashing window paying football.

Protecting yourself from bad actors also doesn't create wealth but it protects wealth you already have.

You know cybercrime and APT groups are not bored kids in their parents basement, there are groups that are running automated tooling to find vulnerable companies and if possible take all their wealth.

Just look at Binance of course, but if you are small company there are also people targeting those especially with AI assistance nowadays.