In organizations with at least some level of security consciousness, from what I've seen, it's employees who consistently cause the most harm. While the FBI and others claim that about half of security breaches are by employees, my experience is that most of them are by outsiders. With most systems connected to the Internet the external threat is much higher. The probabilities of attacks by recreational crackers, ideological extremists, and people with grudges vary greatly by site in a generally obvious way. More important than an intruder's philosophy is their capability.
Some systems deserve more protection than others.
In the book, I discuss how to compute what the cost of a break-in is. For system used mostly for email and surfing, updating the password, turning off unneeded services, and upgrading buggy servers may be enough. Almost everyone makes purchases over the Web, and getting bogus charges removed from one's credit card account can be frustrating and difficult. Certainly most home Linux systems fit this category. Also, there are many, many people new to Linux that need to secure their systems, and most of them are Windows refugees rather than former Unix types.