Government agencies have a tougher time luring workers away from the private sector and, in general, there's a "shortage of cybersecurity talent,"
That's a major part of the problem, from my experience. The government IT people are well-meaning, but for the most part they've been promoted up into those positions because they have some type of computer experience, not because that was the job they were trained to do. They don't think like hackers.