I think the problem is that it's tricky math, and there are so many possible subtle failure modes that make a scheme insecure (e.g., timing attacks). So in order to have a chance of making a new secure scheme, you should be an expert in crpyotgraphy (i.e., be very familiar with past schemes, why they worked, and common ways schemes fail that are non-obvious to someone without such a background).

Furthermore, given the number of subtle failure modes, a new scheme (even one designed by an expert) is likely to be insecure until shown to be secure by time and peer review (i.e., after it has been extensively attacked). Experts know this; amateurs assume that because they can't see a flaw, their new scheme is secure enough to deploy.