If you really lock down master, then true, you've mitigated most of the rest. Most folks don't think to do this, unfortunately.