Military personnel are people too. Regular people. And most of the stuff the do is boring and uninteresting to adversaries. Putting too hard restrictions would just lower morale and risk future recruiting.

So like in any organization you rely on infosec training and hope that it will work. Like in any organization the human factor will cause it to occasionally fail.