That's right. You're right that we're not talking so much about hacking, although if there aren't good access controls, that could facilitate hacking as well. Primarily, we're looking at this: Only the people who need access should have access, and they should have access only to the parts of the system they need to access.
On October 31st, 2018. See this statement in context.