There's an actual name for this fallacy: https://en.wikipedia.org/wiki/McNamara_fallacy

> The McNamara fallacy (also known as the quantitative fallacy),[1] named for Robert McNamara, the US Secretary of Defense from 1961 to 1968, involves making a decision based solely on quantitative observations (or metrics) and ignoring all others.

Which had a profound effect on the Vietnam War

I agree, by the way, we shouldn't focus only on measurable metrics. Humans, and businesses should also value "norms and values". Although I have no idea how to evangelise this

The ROI of security is too noisy at a single company where you (hopefully) get less than one incident per year. But across the industry there is enough data to estimate ROI of various procedures.

You can estimate: https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cyber...

It's just that it is not the norm, so expectations are low. Some companies consistently do better than others, so clearly it's not all down to luck.