Like for instance the legal definition for "encryption at rest" is often wildly different than what a customer thinks that means, what an average SRE think it means, and what a cryptologist thinks it means.

All those regulations like GDPR mean nothing if I can convince a random judge or regulator that an apple is actually an orange.

These technologies are moving so fast that it makes sense why there a lag in understanding and any real attempts at regulating agaists the negative effects.