I do not have answers or facts to offer, but I suspect they are similar in nature to those for the question of “why haven’t we solved security critical bugs? Why haven’t we just heavily invested in software verification? Etc.”