[jonknee]

> For instance why in the world wouldn't they have OS level software restricting read access of a certain secure partition (or removable media) to a specific whitelist of processes? Or why wouldn't they use an airgapped machine?

At some point you have to actually use your exploits, they can't all stay in secure airgapped machines. Malware is made to be used and to be used it must be copied. Obviously taking it home is egregious, but it's not like securing a private key or launch codes.