Because we build things the wrong way.

"We take code and make it secure"

instead of

"We take secure and make it code".

That said, maybe it's impossible. Maybe turing completeness and security are antithetical and someone will always be able to find a way to poke a hole in the system from a lower layer of reality.

In every billion dollar company I've worked at, the infosec team has numbered less than 10 people.

Because it was spent on babysitting C pointers instead of actually writing secure software.