But relatively few of them are internet/user-facing in any given deployment. You only need to secure/audit the attack surface, not the whole stack.