Laugh - no doubt a "security consulting firm" would say that.
Are they correct? Yes, but often context and other considerations aren't fully considered.
For example, I do a security audit of your work area and find you have 34 cents sitting in an unlocked desk drawer. With that desk drawer being "wide open", anyone could take that 34 cents and use if for any purpose, even nefarious purposes! So, what you should do is install this 10 ton safe, with time lock, multiple keys requiring concurrent operation, an alarm system and perhaps a full time guard (subscription), to plug this security hole. Oh, and we're running a special, for a mere $499,999.99, we can provide this for you too, and if you order before midnight, tonight, your first six months of your guard will be free, a savings of $50,000!
Are you protecting 34 cents or a million dollars? Value of what's being protected often very much influences what you'll spend to secure your asset.
Did the "security consulting firm" also audit all hosts for their security vulnerabilities?
The "security consulting firm" suggests Internet access is part of a bare minimum connections for any and all hosts? (Hmm, Internet is often considered a primary vector for "bad" stuff. I.e. what's the source(s)/probability(ies) for a host being compromised?)
Has anyone estimated the initial costs and on-going OPEX costs to maintain this security model?
Again, not saying the "security consulting firm" is wrong, but hopefully they, and your company, have done an analysis beyond just what might be an attack vector but the odds of that attack vector being used and the cost of trying to preclude its usage.
