> Management is never held accountable.

By whom and for what?

The problem with security maximalist[0] ideology is that it does not accept reality for what it is: shit will happen. The correct way to handle risks is to mitigate them to some extent, and then insure (or self-insure) against the risk that remains[1].

Then, when the risk actually materializes and mitigations prove insufficient, you write off the damage and carry on with your day - and yes, perhaps even reward the executives who set up mitigations and insurance that allowed the business operations to continue undisturbed.

Only then, mitigations MAY be upgraded and insurance premiums adjusted, as an event happening is an important new evidence in risk estimate for it happening again.

That's how adults in the room handle security.

It's only the general public and cybersecurity people who see random events happening and decry that somehow it affects them and Somebody Needs To Be Accountable, and Someone Must Do Something About It.

--

[0] - Or should I say, cybersecurity maximalist, because in every other field except software, this is well understood.

[1] - Talking about regular security, that applies to 99.99%+ of businesses; the risk to life and limb is a special case with extra considerations, though it fundamentally doesn't change much about the framework.