> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy

Well no, but they're not off-base either.

Security is best implemented through a layered approach.

Security is also an exercise in risk analysis and mitigation.