Insofar as every security mechanism was made by a human, yes.

But if we're holding users accountable because 1 out of every 100 clicks a link in a phishing email like clockwork, we're bad at both statistics and security.