Why is social engineering such an effective attack?

Because attackers use psychological tactics to extract information from human targets.

Because physical security is the easiest security to circumvent, and people control it$.$

Because social engineering is effective, it's also low$-$reward for attackers.

Because attackers' targets are not trained, and security policies are lax.