What does this equation mean?

There is a simple way to see why capability removal should be the default move rather than the fallback. Model the expected exposure created by a credential as a sum over the capabilities c it carries, each with some probability $p_c$ that it is exploited in a given period and some damage $d_c$ if it is: $E = \sum_{c} p_c \, d_c$. Two of the terms in that sum are hard to know honestly. An estimate of $p_c$ assumes a threat model that has to guess at an adversary’s behaviour, and $d_c$ is only bounded once you have already imagined the worst plausible use of the capability — the same failure of imagination that undermines defense-in-depth probability estimates generally. But there is one operation available to a system designer that requires no estimate at all: revoke the capability, and its term leaves the sum exactly, not approximately. Better monitoring reduces your uncertainty about $p_c$ . Removing c removes the need to know it. That is the quantitative case for treating scope reduction as the first move rather than “we will detect misuse if it happens” — detection is a hedge against the terms you decided you could not remove, not a substitute for removing the ones you could.