Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point