I was being facetious - all systems have to be accessed in order to be useful. Cord-cutting is meant to illustrate the point that they are rendered effectively useless in the pursuit of obtaining absolute security.
Some people think jokes are less funny when they are taken literally, over analyzed, and explained in explicit terms. Even that can be entertaining in its own way, thanks.
All you need to do is take some scissors to your Ethernet cable and put your server in a locked room. You now have unhackable data.
There are absolutely lax security practices out there, but being connected inherently carries risk. Our job is to minimize that risk as much as possible through best practices, but nothing is absolutely bulletproof.
Security isn't a destination either, it's an investment that never goes away. The day a business stops making that investment is the day their risk goes up.
They should be in jail then. If I got caught running something like a stingray without any legal authority, I'd expect to not pass go or collect my $200.
If that's never a concern for them, then this behavior should be expected.