I'm glad someone here gets it. You must be Gen X like me. When I was younger, I was a lot more naive about root causes of these problems. After years of observation, I am just cynical ... but not naive. I'm proud of my accomplishments, and my former manager tells me that my security architecture still has not been hacked to this day. So I know it can be done.
You nailed on the other reason I exited cybersecurity. The vendors selling snake oil and silver bullet solutions for millions of dollars. My life is too short to get caught up in that security theater mess, not with clean hands or a clean conscience. I even came up with an unspoken conversation between my team and development teams, where they say, "We'll pretend we fixed the problem if you pretend it's not there any more." That's the typical attitude.
Sometimes the CIO has (waning) technical chops. Often, if there is one, the CISO may. The average tenure of a CISO is likely less than 24 months and they are first in the line of fire if something does go wrong. Meanwhile, they are understaffed, underbudgeted, and not given proper authority. So you wonder how our society got into this mess? And don't even get me started on regulators and politicians, who are the bottom echelon when it comes to knowledge, and often intelligence.