Why do cyber attackers commonly use social engineering attacks?

Attackers can easily find unpatched applications or systems to exploit.

Attackers can gain what they want while bypassing most technical security controls.

Attacks can go undetected for a long time since they don't require user interaction.

$$