Sure, if you're only worried about local exploits in your stack then keeping your top level application secure means the rest of your stack isn't exploitable. The rest of your stack still exists though and inputs go through all of it before they get to your application so if there is a remote exploit in some part of the stack it doesn't matter how secure your application is. For examples see php2shell, broccoli2Shell, the use-after-free in the IP layer in the kernel (exploitable via MPTCP), and some more that I'm probably forgetting that have happened recently.