For instance, a 51% (I cannot seem to find the study, perhaps someone else has it bookmarked) of compromises result from attacks on passwords; many of those passwords were simply guessed, because humans are neither skilled at producing random output nor remembering long, complex strings. Passwords are a poor solution, and it is the wildest dream of the information security industry to replace them, but it is a slow venture.
Security is also quite fickle. What is safe in one environment can be dangerous in another. tar has pretty solid defenses against directory traversal; you have to invoke it with options that explicitly allow files to be placed outside of your current directory, if that behavior is desired. Except wait, is there a symlink to / in that directory? Nevermind then, you can place files where you'd like. Raise your hand if you knew that.
2. Security is a moving target so even if an application was made with best security standards, if it's not being actively maintained, new security attacks will get through. New 0-days come out on a regular basis
3. Security needs to be perfect or close to it. An attacker only needs to find one critical vulnerability or be able to tie together a handful of medium and lower-severity bugs
Most big hacks could have either been prevented, or detected and limited, if the company had a proper security team with the authority to make the changes needed.
It will take legislation increasing the liability for companies before this gets fixed. The Internet of Things in particular is going to be a massive problem unless manufacturers are liable for the security of their products.
This is the Monsanto problem: lack of genetic diversity.