I’d like to know why info sec has traditionally been anti-science to begin with, and if they are going to adopt data backed approaches to backup their theories,

I’d like to know why info sec has traditionally been anti-science to begin with, and if they are going to adopt data backed approaches to backup their theories, what other old wives tales will they’ll be addressing next?