I wouldn't outright call everyone who makes a security mistake incompetent.

However, most third persons involved with implementing bitcoin-the-actual-token don't get hacked.