After 50 years of software engineering, why are computer systems still insecure? I don't get it.
Two questions: (i) What's so hard about just denying or restricting networked access to bad actors who lack passwords? It's not like these bad actors arrive with crowbars and dynamite; they only have bits and bytes, right? (ii) Once a bad actor has achieved networked access, why haven't operating-system kernels been re-engineered to make privilege escalation unfeasible?
I am not looking for a book-length answer but merely for a missing concept. If you can see the flaw in my thinking and can shed a little light on the flaw, that will be answer enough.
Is there some specific reason top scholars have not yet been able to solve the problem? Is there a sound reason we still have, say, bootstrapped compilers and unauditable microprocessor designs, despite the long-known security risks?
Is there some central observation, answerable at StackExchange length, that ties all this together? Why are computer systems still insecure?
Update: Commenters have added some interesting links, especially "Is Ken Thompson's compiler hack still a threat?"