You could ask that question about the MS outage as well and million other things.
I suppose I can't understand because where I work our scale is small enough that we can have an actually resilient infrastructure and can stay in control of almost everything we need, and when you get bigger it's more difficult? I mean, even an outage from our email provider could be worked around in a matter of a couple hours at most.
I'm really not sure it's not just because most managers are clueless and shortsighted though.
It's a culture thing, if it leans "engineering-heavy", you usually have contingencies, tests restoring backups and lots of other "goodies" that gets skipped if you don't lean that way. Microsoft and similar organizations been a sales-and-enterprise leaning organization for most of its life, so of course they're not gonna think about what happens when their "always online cloud tooling" goes offline when setting things up, it's much more important to finish things quickly and have a long list of features to be able to present to customers.
I get it, we had to sign separate HIPAA BAAs with Anthropic and OpenAI - but we did sign them both, if only to be able to have access to a wider array of models.