Can't they invest enough in security, I don't understand
Of course they do. You just can't know how much security is enough until it actually gets tested, which in this case lead to a breach of their system. NOW you know it wasn't enough, which they have put a lot of resources into to fix, so currently they are more secure than before, but only until the next breach.
Binance isn't the type of exchange to save cost on security. They as the ONLY large exchange have quite a solid support desk, which can't be said about Coinbase and other exchanges of that magnitude. This costs a lot of money to keep running, so definitely not the type of exchange to save cost elsewhere.