I think CDNs make the best effort with the tools they have. However, many PoPs don't have locked racks, biometrics, or cameras.

This means CDNs are limited to where they can safely terminate SSL connections, which impacts latency and ultimately their bottom line.

(Disclaimer: I'm working on this problem.)