Is this because of incompetence, or is it really difficult to maintain a secure database?

Both.

have the Chinese and Russians probably hacked into most every database they really want?

I wonder why you exclude the Americans from the list of the attackers :-/

The answer is no, I don't think so, because while maintaining a secure database is hard, it's not impossible, especially if the said database not connected to the 'net in any way.