I think the same reason that SQL Injection is still so common despite frameworks / orms protecting so hard and even the most broken english youtube tutorial mentioning that security issue

maybe devs just dont care?

maybe they tend to believe "who would inspect our page and try to manipulate form?? no one"?

maybe lack of review?

lack of time?

too much context switching?