The point is not to stop the hack. This is impossible, as you said, if there's a way out, there's a way in.

The point is to make the hack take so much time and be so difficult & dangerous that by the time the hacker has breached your fifth level of defenses he has just enough time to say, "oh crap" as a bullet enters his brain.

It's like securing a house. You can't stop someone who is determined to get in. You can only slow them down enough for other factors to com into play.

or take more time to hack, then the target is online. I think that was the concept behind vanishing SANs back in the day. Show up on a new address each time, exchange the cached data, drop the connection.