Developer ignorance rather than hubris. People who don't really know anything about cryptography has the naive and wrong impression that encryption renders your

Developer ignorance rather than hubris. People who don't really know anything about cryptography has the naive and wrong impression that encryption renders your secret completely safe against anything and that only by getting the key or a major cipher vulnerability would the plaintext be revealed. They treat it like a blackbox because they don't know anything. In recent years, some of the crypto libraries have methods (i.e. Fernet) that are much safer and takes care of these issues for you but it's still very possible to make mistakes. I've seen engineers use a static IV for AES because they didn't know how they would be able to search for the encrypted data other than making the ciphertext the same for a given key and plaintext. Basically they severely weakened it because they didn't understand the purpose of a random IV. Again, they thought key + plaintext -> encrypt = super secure.