Because the pop security YouTube crowd goes through great lengths to avoid these conversations which reveal the limits of their own knowledge and abilities. Because a YouTube channel which just says "you are vulnerable to state actors and should focus on protecting yourself from more benign threats" doesn't generate as much traffic as shilling VPNs.