In general you are correct, however the real deal types either first learned on systems that are barely still relevant or grew up in it and have wired themselves to think like the systems and their users. For them, much of infosec is analogous to a primitive.
Back in the day, school was very much overrated. Before the internet caught on, there were only so many new facts in the books we read.
Like here's one for you. Back in the day, so few people knew even the basic IT shit that one of my colleagues would wear sweatpants and a T-shirt to a suit and tie office. Guy was so bullet proof that he tested it a few times by pissing himself to see if they'd send him home. Never happened.