CVE program

You could argue it's because the people cutting these funds are clueless morons.

Or you can attribute it to the ear whispering corporations not wanting to be put on the spot about their shoddy software.

Or you could think of it from the perspective of a particularly adversarial nation that's overly active in it's cyber warfare wanting to make sure that critical vulnerabilities are left unfound.