Fallacy applies only to incidental breaking of glass like child smashing window paying football.

Protecting yourself from bad actors also doesn't create wealth but it protects wealth you already have.

You know cybercrime and APT groups are not bored kids in their parents basement, there are groups that are running automated tooling to find vulnerable companies and if possible take all their wealth.

Just look at Binance of course, but if you are small company there are also people targeting those especially with AI assistance nowadays.

> to illustrate why destruction, and the money spent to recover from destruction, is not actually a net benefit to society

it is distinct from question whether it is productive to defend from evil people

evil people + protecting from them is obviously net negative!

but it is not changing that of evil people are present then reasonable level of protection from them is needed, and setting it up is productive