There are a bunch of misunderstandings here about the OWASP Top 10 and what the different controls mean.
The OWASP Top 10 is not a list of vulnerabilities but a list of risks
Not all risks mean that there is an exploit that leads to a breach. Therefore, it does not mean that this weakness enables an attack. Nor does it mean that by having sufficient logging that it will prevent an attack.
There are different types of controls:
- As the A10:2017 entry points out, logs are a Detective control. If the system owner cannot see what is happening on the system, then the owner cannot respond to the attack. Being blind is a risk to the system, even if the system is operating within expected parameters.
As an example, security cameras do not prevent anything. But they help the security team look for anomalies and to see the extent of a problem, how it started, and everything that happened around the problem. It's the same thing for logs. Logs must be gathered and monitored and analysed.
Account lockouts are a Preventative control. It limits the attack in progress. Logs capture these attacks and allow the owner to do things like discover patterns in attacks or to discover successful attacks that were not prevented.
Security is a stack of protections just as digital technology is a stack of technologies. One control is not sufficient. Each layer helps protect the rest and the weakness in one layer can be compensated by the strength of others.