I recently stumbled upon a McKinsey article from October 2019 that more elegantly, in McKinsey speak, made the argument against "cyber hygiene" than I do.