Isn't Denuvo actually implemented in a game by the DRM developers, though? I remember reading that they have a process where the game dev sends Denuvo an unprotected executable, who adds the DRM to that executable and sends it back.

Thus, I believe the poor implementations are directly the fault of Denuvo.