> Not really, no. If you're running an application server, then your entire app can get compromised if there's a security exploit in any of your app code, your web server, your kernel, your hypervisor.
That's really not how it works. You reach the compromise part if all layers are compromised. You don't reach the inner layers if you can't go past an outer layer. You're saying that if there is only one layer that is compromised, or all layers are compromised, your app can be compromised. But you're leaving out when you can't go through every single layer. That's the whole premise of defense in depth.
Sure, if you're only worried about local exploits in your stack then keeping your top level application secure means the rest of your stack isn't exploitable. The rest of your stack still exists though and inputs go through all of it before they get to your application so if there is a remote exploit in some part of the stack it doesn't matter how secure your application is. For examples see php2shell, broccoli2Shell, the use-after-free in the IP layer in the kernel (exploitable via MPTCP), and some more that I'm probably forgetting that have happened recently.
You’re both right. If your application is strictly and perfectly layered then you need a vuln through each level in the stack. But in reality apps aren’t strictly layered so you just need “a path” through with the vulns you have. And in most non-trivial apps there are many distinct available paths.