Because they know they have such a chokehold on the market. I remember back in the XP days it felt like every year there was a new top tier security product that people were trying.

Because all software is insecure.

You hear a lot about them because they are used in government and large enterprise environments when threat actors love to attack.
Having a responsible disclosure process where they announce problems so their customers know it's patching time. It's better then it use to be where a vendor threw out a patch and if you didn't patch because the vendor didn't say why the patch was released.

Some of it is incompetence, but some is... more complicated incompetence. A lot of the weirdness you see is where some executive somewhere had a problem that affected him and had enough money/clout to throw around that they could make whatever just happen. Microsoft is the worst at this.

Gotta let some shit happen or people won't think they're doing anything.

Crowdstrike has an impressive marketing budget.

BlackBerry cylance was a better product in every aspect but BB didn’t try to market it after aquiring it.