Until the attacker bypasses your perimeter firewall by convincing an employee to download and install malware.
Having employees (or system like bastion hosts) with unrestricted access is one of the recurring mistakes in such events. I can’t understand it.
And so? This is true for any kind of infra!
You can't defend yourself from everything, but you can try to make you life easier by reducing the attack surface and make side movements more difficult.