Because most breaches of security are found through the tedious analysis of cryptic low-level source code. This is something that is measured in weeks or months and not seconds. For example say there is some part of the system where a sequence of data values is retrieved, but it was implemented incorrectly and if a sequence that is too long is requested, extra data will be returned to whatever other part of the system called it, and this data can propagate all the way up to a level where it is accessible by an external process and therefore a human. Maybe the person finds this by chance or maybe he has written some program of his own to analyze whether the information return matches what is expected. And maybe by chance this extra data is actually useful for manipulation of the system in some meaningful way. When all of this happens, which is like a needle in a haystack, you get a "hack". But this all requires a lot of luck, tons of patience, and autism to even happen.