You must anticipate that a breach will happen. Learn to model different threat scenarios and put in place mechanisms to protect your applications, data, IP, and the resiliency of the device. Your threat model should assume that an attacker will get root (admin) access.