> Such a talent is not a core competency of any firm
No it's not, which is why agile processes have less risk than waterfall processes. You're not making the argument that Boeing should keep all of their manufacturing in-house, you're explaining why Shenzhen has become the hardware manufacturing capital of the world. Shenzhen isn't controlled by a single company, and the ability to quickly order parts from other manufacturers in the Shenzhen area allows hardware manufacturers to respond with the agility you describe. Who controls the individual manufacturing processes is less important than the speed of the feedback loops.
> the idea that you can actually manage risk in a quantitative way is not something borne out by experience
Well, Wall Street would disagree with you.
> We just exited a massive financial crisis
2008 happened not because the underlying risk models were wrong but because people were sold high-risk instruments on the fraudulent premise that they had almost no risk at all, and the rating agencies which mislabeled the risk hid behind the First Amendment. If the high-risk instruments were honestly represented at sale, they wouldn't have been purchased by people seeking low-risk instruments, and the portfolios of most market players would've been well-diversified as planned and able to withstand those kinds of shocks. That the rating agencies were able to hide behind the First Amendment (risk assessments are not political speech) and that nobody went to jail for the fraudulent risk assessments remains a great injustice, in my opinion.
> we see security breaches on a massive scale
Because law and regulation do not set sufficient financial penalty for insufficient security practice and the market at large has shown not to care enough about security to punish players with poor security practice, so the financial risk of a breach is (in my opinion, unacceptably) too low to cause a change in corporate behavior. Again, not an issue with risk management, just people responding to systems as designed.
> Putting together a bureaucracy to control something doesn't mean that it's controlled.
Sadly I actually agree with you on this, which is why I wrote, and I quote, "competency at shifting numbers around on bean-counting accounting sheets is not the same thing as competency at outsourcing".