Good security requirements

Why do good security requirements go bad? What can be done to prevent things from going bad?