On whether it's being unable or unwilling: one could argue that various gov agencies actively invest in keeping software insecure, e.g. by buying up zero-days.