I mean, we have a room full of people whose job is to ensure the security of the products we rite, but she knows that we are actually the problem here

Actually, I have known and worked with people with less conception of security than her. People who never figured on wanting a web server on a different computer from the main corporate database fer instance.