How does a child theme protect from exploits?

One reason to use a child theme is so that if a theme needs updates in the future (such as twentytwelve) then the theme can update and won’t erase all the changes you made.

However, I don’t get this. Let’s say I want to change my header.php for twentytwelve. I make a copy of header.php from the original theme file, and then I put it into my twentytwelve-child directory and make whatever changes I want.

But let’s say there was some exploit or problem with the header.php from the twentytwelve theme. Even if wordpress updates that header.php file in my twentytwelve directory, twentytwelve/header.php will never be called because the twentytwelve-child/header.php (with the vulnerability still inside of it) will always be called.

I think I am misunderstanding something here so could someone please clarify this for me?