Skilled and dedicated people and an organization dedicated to maintaining a consistent level of security. Maintaining both of these long term seems to be the challenge for many companies.

> You don't hear about bank mainframes getting hacked often.

Who do you think employs the top-level criminals?

It makes systems harder to work with and new features slower to deploy and it requires you to make sure you stay on top of CVEs.

That's overhead that businesses really hate paying as it's diverts software devs away from making new features.