Yeah, that's basically it: software sucks for economic reasons. It's insanely expensive to create good software, and even if you spend a lot of money, you're not guaranteed to get it.

I think there are some tragedy of the commons situations though, where everybody is relying on extremely underfunded common infrastructure. It was only after a bunch of expensive security holes that the users of this software started to pay more attention:

https://www.coreinfrastructure.org/

But there is plenty of other stuff that needs to be done, that would benefit everybody, and doesn't involve security holes.