A workload has a private IP and still runs vulnerable customer-managed software. What is the correct security position?

1. Vulnerabilities matter only when a resource has a public IP.
2. Storage encryption removes every software exploit.
3. Private addressing automatically patches every binary.
4. Private networking complements, but does not replace, patching and workload hardening.