Why do most real-world breaches still come down to simple mistakes?

i’ve been reading more about recent breaches and it feels like a lot of them aren’t due to some advanced exploit, but rather basic issues things like misconfigured cloud storage, exposed credentials, lack of mfa, or overly permissive access even with all the tools and awareness around security, th