Well, it doesn't have to be that complicated.

Just underfund the security department, don't adopt systems/languages that prevent the worse bugs, and keep the core protocol proprietary.

On the other side let the governments invest in operations to hack the product.