Exactly this. And, of course in practice, it's also the OS, firmware and so much more.

Your comment speaks to exactly how people underestimate the true attack surface. It's far more vast than most anticipate, and their conception of it tends heavily towards the literal surface.