Because once you learn enough of the stuff you start to realize its all bullshit. Compliance (hipaa hitech, pci, sox) and most industry standard practices (antivirus, firewalling) are lipstick on a pig. Very often you have to chose between being secure or standard compliant (for example running antivirus can be a big security hole, or give false sense of security).