Why doesn't the engineer's manager require code reviews for all check-ins/patches before running in production? Why doesn't the CEO, or anyone between the CEO a

Why doesn't the engineer's manager require code reviews for all check-ins/patches before running in production? Why doesn't the CEO, or anyone between the CEO and the engineer, mandate that all engineers writing production code take courses in writing safer code (e.g. sanitize all input, no exceptions)? Why doesn't the CEO pay for code audits? I wonder how many companies who have 'leaked' data recently are doing these things. Granted, it will never catch all bugs, but avoiding these things is negligence, which should be punishable.