Historical examples of bad security policies/mechanisms that we got stuck with through switching costs?
There were some boo-boos with WiFi, thus the various generations of security protocols. Fortunately, most of the heavy lifting is done in firmware that is uploaded to the card/computer.

Initial (analog) cell phone technologies were trivial to intercept, newer (digital) ones much harder, but there were (are?) still gaps. Needless to say, switching required redoing much infrastructure and everybody getting new phones.

For some entertaining war stories, check out Ross Anderson's "Security engineering" (available as PDFs for each chapter on his homepage). Nicely written, a real classic.