It’s difficult to fix issues on compromised machines, for example. Or buggy VPN. Etc.

Sometimes it really is a specific person’s issue, and sometimes there are a lot of them so it can look like a vendor issue.

Of course, sometimes it is a vendor issue.

There is a percent range where it is difficult to differentiate. Made worse by a large user base.