Because software defects are more common, easier to exploit, faster to exploit, cheaper to find, and massively more consistent to leverage.

If software improved to the degree that hardware and physics-level exploits were the easier, we would be in a world 100x more secure than what we have now.

The real question you should be asking is why is it not “game over” right now given that most people would only hope in their wildest dreams that they would be so lucky that worrying about Rowhammer and the like would be a good use of time compared to the other much larger gaping software holes.