It does seem like at many places this person will be in charge of managing optics, rather than getting the workers training and priorities straight for making trustworthy software.

For one it’s always been easier to not get caught than to do the work. And even people who do the work will generally agree with that. It’s not about easy it’s about looking yourself in the mirror.