What does this equation mean?

Two of the terms in that sum are hard to know honestly. An estimate of $p_c$ assumes a threat model that has to guess at an adversary’s behaviour, and $d_c$ is only bounded once you have already imagined the worst plausible use of the capability — the same failure of imagination that undermines defense-in-depth probability estimates generally. But there is one operation available to a system designer that requires no estimate at all: revoke the capability, and its term leaves the sum exactly, not approximately. Better monitoring reduces your uncertainty about $p_c$ . Removing c removes the need to know it. That is the quantitative case for treating scope reduction as the first move rather than “we will detect misuse if it happens” — detection is a hedge against the terms you decided you could not remove, not a substitute for removing the ones you could.