You could make the same observation about physical security. Pretty much every mainstream security system or setup in existence is apparently trivial to beat for a sufficiently determined adversary, and many real world things aren't well constructed in general.
The answer is probably a combination of:
A: Most people not drawing attention from said adversaries (rival states, etc)
B: Security in numbers, or so many potential 'targets' that the average site is likely unaffected by probability alone.
C: The majority of the population being decent people who wouldn't do anything dodgy anyway.
D: Most adversaries being opportunists or incompetent