WebKit has a lot to do with that. It's not that it's particularly bad or insecure code... it's just a much larger attack surface than had previously been available on most consoles, and the console manufacturers haven't always been very good at keeping it up to date.
Addendum - the original XBox hardware mods were pretty easy too.
This became a cat and mouse game between hackers and MSFT as MSFT started measuring things like latency and expected angles between blocks of data on the physical media to tease out whether the reported legit disk was actually legit or an imperfect copy.
I remember a few ban waves where people using modified consoles had their Xbox Live accounts shut down, then I stopped following it after that.