This is part of the Innovator's Dilemma--people tend to keep doing what is working "well enough" because they can't be blamed for that, and opportunity cost tends to be invisible unless it's looked for. Meanwhile, a competitor with less to lose is more likely to take the risky bet. If they succeed, they eventully beat the former incumbent.

Edit to add: in the case of hiring, CYA can mean hiring someone who's no different from anyone else currently employed in the company--and therefore perhaps missing an opportunity to create positive change.