That is an unfair conclusion. These people run complex networks like the rest of us, they probably have a range of detection systems and, also like the rest of us, an almost impossibly large attack surface to consider internally and on their supply chain.

The problem is that it is really, really hard to make something secure even if you try and follow all the best-practices you know.

I guess the awkward bit is marketing everything as certificate this, accreditation that and overselling how secure it is although I don't really know how else you would word it, "as secure as we know how"?

Those aren’t the people in charge. People like 93 year old Senator Chuck Grassley are calling the shots.