Because they are very difficult for security engineers to detect.

I think that Security Engineering is a relatively safe career, unlikely to be fully automated anytime soon.