No computer system, or even individual computer that has the ability to be turned on, is 100% safe. Every system can be compromised, if the attackers have enough time and resources.
So, your last sentence is true.
However, there are ways to secure things in a practical manner and ways to detect, and stop, intrusions - though those ways look nothing like they do in the movies.
There are practical ways to limit exposure and to make data exfiltration more difficult. There are layers and practices that can be put in place to make it more difficult to do and easier to notice.
They are expensive and they do impact efficiency and may impact efficacy.
The easiest way to avoid data exfiltration is to not store it in the first place. But, that means they are less able to track the consumer and then less able to do effective targeting of ads and things like that.
The bottom line is it is expensive to reasonably secure your systems and the penalty for not doing so is less than the profits being made from not securing their systems in a reasonable manner.
Without larger penalties, this is unlikely to change. Maybe, just maybe, enough people will be impacted to where they actually start imposing serious penalties for negligence or willfully neglecting security. Maybe...