True, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.

Not if your threat model is “bots that scan the internet for vulnerable installations of X”.