it's more an industry standard than anything else coupled with government bureaucracy, giving out the task to the "cheapest" option who will obviously cut corners (which is always safety/security). it's the same when governments get companies to build roads and bridges, they choose the cheap one and then it collapses a couple of years later. but on top of this it is software which boomer government official's brains cannot understand or comprehend, with no way of setting proper requirements and doing follow-ups/testing.
Denmark