I'd say it's true at the extreme end but not really true in the middle. For real-world systems, there are often security improvements which don't impact usefulness, or even improve it. For an example, imagine something like gmail that uses plain HTTP. Upgrade it to HTTPS, did it become less useful? If anything, it became more useful, because you can now use it on public WiFi networks without worrying about being hijacked. If the backend is also secure then you can use it to exchange private information you wouldn't transmit in the open.

The major conflict right now isn't because there's an inherent tradeoff between security and usefulness, it's because if your users are idiots then "secure" becomes problematic. For a smart and knowledgeable user, "secure" can be considered to be roughly synonymous with "do what the user wants, and only that." With idiot users (most of them), security requires protecting them from themselves. For example, with knowledgeable users, protection against malware can be accomplished by signing apps to show who made them and running them in a sandbox where the user controls what permissions the app has. With idiots, none of this does any good, because they'll click Accept when Blofeld's Stealy App requests permission to withdraw money from the user's bank account, if there's a slick gem-matching game attached. And idiots can't be trusted to know that they're idiots (because they're idiots) so having an "advanced mode" doesn't really solve the problem.

So really, the problem is deciding what "security" means. Does it mean your computer can't be subverted by outsiders? Or does it mean your computer can't be subverted by you? Increasing the former kind of security tends to improve usefulness, but increasing the latter kind harms usefulness.