Libraries also have a extremely difficult task, they have complex, bespoke/customized older technology backends.

Their systems are largely open to the public, their computer spaces might be the only computer some have access to. There was a time when the advice about a dodgy file was to just open it at the library computer.

Much of their staff might be outreach hires and so limited/no workexperience that might have endured corporate training around information governance or cyber security.

And they do that on a budget where they can't afford shoe strings.