I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be accessed within the organisation's network only.
Recently, a third party Apache library's security vulnerability (apparently, a remote code execution one) was published. Our security lead had asked us to upgrade the library to the latest fixed version immediately.
I had asked, "Since the portal is accessed only in the intranet behind a firewall, do we still need to upgrade the library?". The lead could not provide a detailed explanation due to lack of time and confirmed that the upgrade needs to happen regardless.
So, what's wrong with the statement (assumption?), "since we are behind a firewall and such vulnerabilities do not affect us".