That's probably just due to lack of demand. Competitive new operating systems are so expensive that nobody writes them anymore, they just use Linux, and then you don't need so many people working on that for anything except drivers.
In the unlikely event that there starts to be shortages of kernel and firmware devs then salary changes will be enough to sort it out. Fundamentally, that sort of work isn't that hard to learn. C is not a complex language, the design is normally fixed by the hardware and software environment that's provided, the APIs don't churn every five minutes and so on.
As for SGX. Security is always hard. If your metric for deciding if someone understands something is "they never make security bugs ever" then you'll be perennially disappointed in how nobody seems to understand any really existing system.