To be honest, I don't think laziness is a problem, either (or at least, THE problem). The problem is the utterly impossible goal of 100% security from all possible threats with a nearly unlimited mandate to do so. The goal is improbable, the consequences dire, so the result is the mad scramble to do visible things. And so we get security theater instead of reasonable precautions and courage in the face of a statistically insignificant threat.
