Kubernetes was built with no program for how to do important things. Every important thing in Kubernetes is post-hoc, poorly bolted-on patch instead of real solution.
Take for instance upgrades. Don't like upgrades? -- Try downgrades? -- Oh, what do I hear, you seem to not like that either... So, how about user management? -- Also no? -- Well, how about backups and recovery? -- What, again?
Kubernetes solved some easy problems quickly with no program for how to solve hard problems. Security is one of those hard problems Kubernetes has no idea what to do about. The reason? -- Kubernetes, on its own, provides very little. It doesn't know how to do networking -- you need a CNI for it. But there's no good interface in Kubernetes to allow the admin to somehow control in general how the cluster is supposed to behave. Maybe some container somewhere will do something tricky, and will punch a hole in whatever firewall you though you've built around it. And you cannot make sure upfront that's not going to happen. There isn't a single way to punch that kind of hole... and the problem is, often time simply to make things work Kubernetes users will punch those holes. Maybe because they don't know how to do things better, or maybe because there isn't really a better way, or the better way is so tedious and convoluted that nobody will really follow it...
It's unreasonable to expect anyone to be able to deal with this kind of complexity. We need to be able to manage complexity, but Kubernetes gives us no tools to do it. It's the same type of problem as Dijkstra described with "goto" -- it's the tools fault. It creates so much complexity that humans cannot cope. Not only humans, computer programs cannot cope -- too many things to check, to many possible problems to protect yourself against.