In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."

That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?

So why have government employees and contractors been so lazy and incompetent as to not improve defenses by a similar margin?