Even prior to this recent cavalcade, the way we have handled security been seemed fragile. We tend to build with the assumption something is secure, and then patch as required.
A huge amount of the machinery relating to computing today pertains to security. Much of the need for that same machinery would significantly lessen if we didn't connect every damned device to the internet. We need to go back to designing for offline first, and secondly, significantly reduce the Kevel if trust of any code that originates externally. Attestation, notarization and signing has improved the situation, but still leaves massive gaps. Normalising the execution of third-party remote code to view a website in the form of JavaScript may not have been a crash-hot idea either.
We also seem to have forgotten that the "A" in the security triad stands for "availability" - yet we have further normalised losing access to our devices and systems multiple times a month for security updates and patches, delivered online to prevent against online threats. We've normalised devices becoming obsolete because they no longer receive security updates for vulnerabilities that never should have existed.