Ok, back to this then:
If everything reports open then what ports do you focus on first?
I don’t see an issue here. An attacker would be overwhemed with choise and excitement so that he wouldn’t be able to decide which port to choose first, get stuck for a several months unable to decide? He’d toss a coin then.
but an attacker isn’t obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him