Part of this is because you have to pay the salaries of the investigators, so there is a cost of detection. It's not worth recovering an amount that is less than the cost of an investigation. Secondly, a company will lose customers if it has a reputation for having too many false positives or a default stance of mistrust of their policyholders.
It's wonderful to not have to trust too much. Instead to rely on evidence and have a contingency if things go horribly south.
Did the IETF miss a vulnerability when they inveted the protocol? Was there someone on the team planted by the NSA? Do the cert authorities provide the means to hack my data in some way?
I don't think they do but that is because I trust them that I don't think it would be in their interest to do this and I think that if the IETF messed with the protocol, someone would have noticed but we have seen OpenSSL bugs that have sat there for years because it was too complex for most people to understand.
It just sounds like turtles all the way down because ultimately you have to trust someone or something even if it is just time and experience.
That's why an effective police, punishment for business crimes, and law enforcement even when the person moves into a different place are important. A more trusting society is a happier and richer one, so we should make it easy to trust.