If you’re blaming email for breaches, you’re missing the misconfigurations attackers actually exploit.