The simple answer is because many breaches happen because of human error. Insurance is there to be a safety net in the eventuality of a cybersecurity attack regardless of where it comes from. In order to insure you, most policies want to make sure they don't have to worry that your employees are the very preventable reason why you're experiencing a breach.