Plus, all the machines that can access it are similarly secured. The OS is secure and the users are all vetted and non-hostile. This network resides on the floor of an office building, with armed security guards and multiple layers of physical access protection. The network has it's own UPS's and generators, and all the machines are in heavy hermetically sealed containers that are EMP hardened. Attacking this network to steal data might be very difficult, but it is still possible for an attacker to deny your access to it.
Security is never black and white - rather it's one big ugly shade of gray.
A machine running ancient software with poor passwords that is physically secured and not attached to any networks can be far more secure then an up to date machine with all the latest security software, on a public network. Security is about risk management. Most people probably are, since the chances of this happening are slim and the cost of protection is high. On the other hand, if you want to prevent someone from breaking into your mail server via the Internet, a reasonably common occurrence, then investing in a firewall and keeping software up to date is probably a cost effective strategy. However, all these measures are absolutely useless if no one responds to incidents.