That is almost a fundamental statement, requiring logical proof.

It’s like with a computer program that can contain vulnerabilities - fixing vulnerabilities might introduce new ones, and new functionality intended for security can contain new vulnerabilities in itself, possibly making the whole even less secure than without it.