You are overlooking the fact of the OSI Layers 8, 9 and 10 problem. Technology has been in place to prevent, minimize, and or disrupt most attacks for years. It does not matter how much more technology you create, theorize, adore, if the processes are broken. Most organizations that have been breached had more than sufficient technology to minimize access, authorization, and the ability for threat actors to escalate. Most if not all failed to have the proper "security architecture" in place. By architecture, I mean foundation.
Envision a database server if you will. Nothing fancy, an MSSQL system that needs to interact ONLY with a webserver that makes a query:
Client -> Server Now ask yourself, if that is the only connection that needs to be made, why would you NOT at minimum implement a firewall policy on that server itself that says: "You can only talk to this system (client)" The process/interconnection is not understood and or defined often, and this is what leads to data exfiltration. If I am on the network via way of malicious software introduced to say a laptop, I can compromise that DB and use that DB to pivot, etc.
Now as far as software is concerned, it means little to make security too complicated as it will often makes things worse/slower/less user friendly. So the more you tack on, the higher the likelihood users itself will seek to bypass: "I'll just turn of SELinux because it prohibits me from XYZ." In trying to solve one problem (poor code/practice/design) you created others. When I pentest, I am exploiting human errors moreso than technological errors. You can't fix humans.