More than two decades ago now, I was privileged to be on a team of security experts that fully defined a system for deploying legal wiretap capability in cable ISPs in a secure manner.
To the best of my knowledge, not a single ISP deployed what we defined. Instead, they listened to the marketing people from various companies that sold them proprietary equipment.
The real problem, it seemed to me then, and still seems to me, is that the people in charge of making deployment decisions really don't understand this stuff (a classic statement from one very large ISP at the time: "We don't need more security; we have firewalls") -- instead, they seem only too happy to be wined/dined/golf-gamed into deploying something that any reasonably competent security expert would recognise as, let us say, sub-optimal.