100% that.
Especially that working software over comprehensive documentation part, which can be automated so easily if done right.
There’s so much value in TDD and providing a way to do integration and automated UI tests early on in a project, yet none of the companies I’ve worked at made use of it.
Also automated documentation tools like Swagger are almost criminally underutilised.
Introducing a Captcha on a form on my website basically blocked bots 100% of the time. It’s arguably good enough from a practical standpoint.
If someone really wants to exploit my site, then they will find a way. You can only make it harder but never truly impossible if you don’t want to dispose of all convenience.