It seems like this is a plea for something like “real security” rather than “band-aid security”, with real security meaning things like memory protection and encryption and band-aid security typified by virus protection.

Unfortunately, the current environment seems to require both sorts of security even though band-aid security has the inherent problem that it can facilitate powerful bad-actors like states (who can lean on virus protectors, suppress information and so-forth). Not sure if there’s any easy answer here.