All security certainly has loopholes that can be hacked by hackers. no system is safe.
All security also depends on the individual using it. If the system has been updated to the latest security, but the user is still not alert, the security used will be useless.
there are many ways that hackers do to break into security systems. Personal bitcoin wallets or exchanges become vulnerable when ignoring the security used. using 2FA authentication does help, some other security can also be applied such as authentication on phone numbers and e-mails etc.
Exactly, there is always a flaw in any system, if the hacker has enough time, motivation and skill he can enter in any system, this is why probably one of the easiest ways we have to protect our coins is simply to remain silent and tell no one about it, if no one knows you have coins then no one will try to hack you, also hackers do two different kind of attacks, high effort and low effort attacks, high effort attacks are reserved for big targets like exchanges, so a regular user that does not use exchanges should not be worried about them, the other type of attack which is low effort but that targets many users at once is what you are more likely to get, but those attacks can be easily avoided if you have the right knowledge about the most common ways to get hacked or scammed.