Part of this is general attitude towards all hacking - that systems can “never be secured”, it is never the designer/implementer’s fault, and we should just blame the bad actors.

When banks/financial systems can get away with not upgrading a decade old Java framework with 6 month old struts vulnerability, and just blame the hacker, it is not surprising the average school sysadmin will do the same.