It doesn't have to be that way. Certain approaches like "hire a bunch of consultants" or "buy more security products" or "hire smarter people and tell them to

It doesn't have to be that way. Certain approaches like "hire a bunch of consultants" or "buy more security products" or "hire smarter people and tell them to be really careful" aren't going to fix the fundamental problems. I see two main issues, one technical and one economic. The technical problem is that we should be ruthlessly eradicating undefined behavior at all levels of our hardware and software stacks, and to the extent possible constructing applications out of building blocks that are very difficult to misuse. Among other things, this means not writing software in C or C++, which is a hard sell to a lot of people (especially if they're writing operating systems). The economic problem is that it's nearly impossible for a customer to know whether a product is secure or not. If secure products are more expensive to produce than insecure products and customers are not willing to pay more for secure products, the result is that insecure products will be more successful. (See George Ackerloff, The Market for Lemons.)