Is it really surprising that DEF CON went where the money was?

Most cybersecurity work in the US, by volume, rolls up to one of about five organizations - all of whom are US government entities.

Most cybersecurity work has nothing to do with keeping Russian bot farms out of outdated WordPress installs.