> Some of that is scaremongering

Some alleged systems administrators *need* scaring. In system security, paranoia really is your only friend.

> the enthusiastic child would have to gain phy[s]ical or remote access
> though firewalls

Put not your trust in firewalls, nor in any locks and keys. Relying solely, or even majorly, on having put a firewall around all of one's vulnerable systems is what I call the Eggshell Security Model: once someone's got through the hardened periphery, everything goes runny. (And these days the site periphery, for many good business reasons, is more a line in the sand than a stockade fence.) Defence in depth is the name of the game here, including hardening the user-level systems, and keeping them fully patched.

.... Sorry about that. After a quarter of a century of being an admin with a systems-security fetish, and having had to clear up after multiple successful script-kiddie attacks, the stain goes deep.