I've been trying to setup a tech club at my kids school. I wanted to do an actual hacking club, and then washed out the fun to just make a sort of introduction to Linux. The school said no to both (I'm currently working on a microelectronics club, but they may well say no to that too).
What I learned is that teachers have literally no time for anything. I mean none. Even "just" getting them to clear the way internally for me to take over an deliver the club was hard - and at that point they were pretty keen on the idea. So if teachers need to spend 5 seconds extra on something, then they're going to work around it if they can - be that security or something else.
Secondly, I learned that thje IT people running the school systems are nice enough, but they're windows people. UK schools use Windows top to bottom, and so they hire "that sort" of admin. Without trying to slag them off to much, my experience of "windows only" admins is that in general they're not actually terribly good. They can keep some windows things working, and they somehow have a strong enough stomach to wave the mouse around endlessly on a desktop machine to get it setup or working or whatever, but they just follow the procedure. There are exceptions of course, but I seriously doubt you could have a conversation about the effects of randomness on AES keys, or TLS setup flows, buffer overflows and memory safety or a miriad of other deep topics. They just don't need to know that stuff to be able to operate Windows systems.
When faced with a guy like me offering to teach kids about Linux (even on a server outside the school network), they worried that the kids would learn things the school didn't know. All of it is outside the curriculum, so the Head of Computing doesn't know it either. I'm absolutely sure kids could run rings around all of them in short order, and I'm also sure the "lure" of all that "forbidden knowledge" is pretty strong - I know it would have been for me at that age.
I'm not sure what the answer is. I'm all for teaching kids Linux and security - and I'd be super clear about the "rules" too. Leaving a void doesn't look like it's working, but schools aren't made of money, so amping up their security and the types of people that look after their systems doesn't look like an easy option either.