> Engineers do, why can't hackers do this?

That can be difficult if security features rely on humans not being able to subvert the process, I think. But for other processes, this should be the default!