Prevention is orders of magnitude less expensive than dealing with the fallout from an eventually inevitable atack.

The tragedy is that in the absence of attacks, local governments don't always allocate the necessary funds to employing competent admins who take a proactive approach to security.

Even more importantly, these admins need to be given authority to block attempts at lowering defenses in the name of convenience or "money-saving".

True, but not always. Also, until something happens nobody would approve budget anyway. Exceptions from this rule are rare.

Depends, but usually the problem is that it is difficult to properly assess the probability of a successful attack and to get decision makers to believe that number.