The threat model is totally different, so the metaphor fails horribly. I could, theoretically, do some horrible thing to a chemical plant, but if I'm going to put that much physical effort into it, driving a truck bomb up to it is way easier. Preventing that attack is infeasibly expensive. So the obscure stuff is hardly relevant anyhow, when the straightforward stuff works fine.

I could, theoretically, hack a medical device to do something horrible... in which case I might be able to kill someone untraceably, from the other side of the country, with no consequences to myself, and possible dozens or thousands of people at a time, and all it would have taken to protect against this is a programmer adding one line of code that would have checked for the buffer overflow. Or using one of the languages designed with preventing buffer overflows in mind.

It's two things so different that they just aren't comparable. We aren't going to secure our electronic devices by not spending time thinking about how to secure them, and that can not help but manifest as ways to attack them.