Often because you only have so much time in the day, so you can't actually verify all the code and hardware. Once you realise you're going to need to deal with

Often because you only have so much time in the day, so you can't actually verify all the code and hardware. Once you realise you're going to need to deal with running stuff you don't entirely trust, you it makes some sense to extend this beyond the bare necessities and dip your toe into productivity improvements. Problem is, much of the industry is full of charlatans that copy and buy as opposed to understand. You end up with orgs that spend $20 million security products but refuse to pay for the expertise to configure it. The reality is we have, we have a lack of skills, especially around InfoSec and most people just mimic what they've heard, rather than really think about it. On average, companies don't compete for talent, and they don't have enough skills and discourse to hire better than they have anyway, so it doesn't really matter what they run.