> Average tenure for a CISO is lowest of any C suite.
Do you have any stats to support this statement? I work as a Information Security Officer, other firms have BISOs or other names for this kind of position.
Additionally, a lot of what you are describing is either cliché ("you can only be wrong once"), only true for certain types of businesses or regions. There have been examples where CISOs have experienced legal pain in the US, see Uber's former CISO. But I would not expect companies to see this as an exemplary case.