Just to expand on that nuance then, "attacked" is not restricted to "successful attacks".

The most popular widely deployed software will be the most valuable to attack. That most fail is a function of other properties of the software.