Why Is Preventative Security So Difficult?

How do we prevent entire classes of issues from happening in the first place?