Here is another example how you can do everything right but still have a security weakness.

https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/