[piaste]

Because there isn't a Big Book of Industry Best Practices everybody can trivially agree to use?

Sometimes they don't exist - who maintains a sufficiently reputable list of safe email clients and web browsers?

Sometimes they exist but they carry some baggage - the FIPS standards for cryptography are probably fine, certainly better than hardcoding a couple of algorithm names, but they're also controlled by a foreign government.