Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and shrugging ambivalence, and you give good examples.
> Go look at /r/sysadmin or /r/
Please, I'd rather not :)
> executives who believe they're above things like "phishing awareness campaigns
My goodness I've met them. They're basically paid too much. I had to make a humint/influence piece for a major bank in London. Cybersec referred to it as "the cock problem"; basically mostly male with high six figure salaries whose security weakness was they "don't give a fuck". Same kind of fellas who would get pissed-up and drive their Aston Martin DB into a children's play-park. Major liability. They've learned they can transgress with impunity and just use money to solve it. What do they care if other people's money gets hacked? Not the best model for business, which requires a more upright mind-set to excel at. But banks don't exactly need to compete in a real business world.
> Technical measures are much cheaper and vastly more effective
Only in the short term. You'll need to forever keep your technical measures one step ahead of the mixture of malice and idiocy out there. A changed culture replicates and even grows itself.