You'll have these arguments - we've had too many to count - trying to convince stakeholders to prepare the precautions you think are warranted. Stakeholders will say no, that's purely theoretical, it costs too much. You win some of those arguments, you lose most of them.
Five years after you have the conversation, it turns out an attacker did think of it about a year after your boss decided not to implement the precaution, and it's been stealing your data for four years.