We should all admit that we don't know what we don't know. But the default behavior afterwards should be to assume that the software/system is insecure, fixing the defects we can find and surrounding in by rings of moats (defense-in-depth). When you don't know what you don't know and then declare it to be secure, there's an extra layer of indirection and perhaps a bit of hubris.