Due in no small part to the profession of network administration deciding that "security" was in fact not about writing secure software, but configuring firewalls to block every port but 80.

Sealed by the decision of ISPs to provide a piddly 1m up even on lines with 50m down, disallow inbound connections to residential modems, etc.