How is that not critical infrastructure given legislators' need for secure and accessible communications?
To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.
Two-factor authentication increases complexity in every measurable way but mitigates against a number of softer attacks.
Adding encryption adds a ton of complexity but effectively removes all man-in-the-middle attacks.
The simplest way of storing passwords is in plaintext.
Privelege separation is far from the simplest way of structuring a daemon, but it effectively prevents exploits in the complex parts from allowing an attacker to gain remote root access.
Perhaps it is more that superfluous complexity is the problem.
I don't think it's that simple.
There are two ways you can look at simplicity:
1. The lack of needless complexity, which is just another way of saying something is well built
2. Smaller modular components that do less and have clearer interfaces, ie: the unix way.
If you mean the 1st, then sure, the main reason systems aren't secure is lack of being well built.
But if you mean the second, all you're really doing is taking security concerns and spreading them out over more components. This makes them easier to reason about, but also means more entities need to reason about them. Like all things in engineering there are only trade offs, no pure wins.
Pentests can't catch everything, so a simple system costs less to secure.
The downvotes are just my regular stalkers.