Because it's uninteresting except to some small subset who just happens to find that an interesting problem they happen to like to work on. Everyone has their

Because it's uninteresting except to some small subset who just happens to find that an interesting problem they happen to like to work on. Everyone has their own particular things they happen to become interested in, so some few people are into security, just like some few are into stamps. But outside of that, security is merely important, not useful or interesting or productive or functional or cool or fun. Fundamentally the useful function of any machine is to do something. The problem that is interesting and fun and gratifying to solve is how to get that something done at all. Other considerations like optimizing the design for some parameter like manufacturing cost or materials availability or reliability or field repairability, or writing the documentation, are all secondary puzzles that can be gratifying but are far less so than the initial creation. It's gruntwork and 'mere engineering'. Figuring out how to ensure that the machine can only be used by approved people in approved ways at approved times and log all activity for auditing... that is even less interesting than optimizing or documenting, unless that just happens to be your kink. It's hardly a boggling mystery. It's like asking why developers don't seem to like meetings and 7 bosses.