one thing I’ve noticed that’s not really just security related, more a cultural phenomenon, is that people aren’t really trained in management. They’re trained in technical stuff, but not people stuff. People don’t become managers by being trained in managing, there’s a lot of seniority based promotion. Essentially someone will have a senior role, and a company runs lean so the only candidate for a manager position is someone who isn’t really a good candidate. So you wind up with people who are technically awesome but management stupid. A mechanistic description of the Peter principle (people will succeed until they reach a job they suck at and then plateau [which leads to people in important positions that they suck at]).
Combined with what you’re saying, the people that leadership is supposed to be able delegate to, and receive feedback from are often less than stellar.
(Exceptions exist)