I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the

I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the necessary resources to protect themselves. It could be argued we're saying the same thing, but your statement has subtle undertones of "IT is failing to do what they're paid to do" instead of the reality of "executives and board members are focused on absolute profit and don't have any legal or financial consequences to being hacked". Most C-levels that have left "as a result of a breach" for the incidents in the past decade do so with a massive golden parachute. Then after a vacation go work for another company with no consequences. They're actively rewarded for this behavior right now.