Most GSW victims are killed by one or two bullets, not hundreds of them.

You don't need a "vast majority" of criminals to break down a system and exfiltrate data when just a single, possibly state-backed, criminal operation can break your system down and do the job.