This is just my opinion, but I think a lot of it has to do with requirements.
NASA is first and foremost about prestige (even above science IMO. This is also - again my opinion - why NASA hasn't been back to the moon in 50 years. There's little prestige to be gained for an expensive operation). With prestige as the backdrop, it makes them very risk adverse. There are layers and layers of requirements made to reduce risk. To their credit, SpaceX is willing to fail more than NASA and it allows them to iterate much faster.
This is also my opinion part of the reasons why NASA wanted the CCP to begin with: it allows them to skirt many of the requirements. The somewhat ironic part is that NASA pathways to alleviate those requirements, but it's somewhat common that project/programs want to go through the waiver process and formerly accept that risk.
There is a fairly well-known dynamic in govt contracting where a contractor low-bids to get the contract and then makes money on change-orders. If they were to accurately bid on all the NASA requirements, they risk their bid being so high they would never be awarded the contract. This is a similar dynamic to the traditional cost-plus contracting paradigm.
There is also some irony in that SpaceX may be the victims of the same dynamic. As failure occur, they may layer on more requirements that ultimately slow the process down (see the supplier quality issues related to an F9 strut failure). Given enough time, there is a risk that added requirements turn them into the dinosaurs they are replacing.
Also, as others have brought up, NASA has additional requirements they must manage (e.g., political risk) that SpaceX has less exposure to.