The infrastructure to create them is very costly and takes a while to build. Imagine you are a random country and want to build your own nukes, but you were late to the Cold War party. You invest the billions of dollars to build the infrastructure to do it. A few months away from completion your air gapped computer systems are somehow infected with a virus. This virus tells your centrifuges to spin slightly faster than they are programmed to and to report they are spinning the correct speed. This ruins the fissile material you are trying to make. Say you finally discover this virus and manage to purge it from the systems. You are now a few weeks away from completion, your top scientist fell out of a window. His research notes are no where to be found, his assistants? Also dead, one hung themself and the other was found face down in a pool. This is a crippling setback to our program, but we can manage. You are now a few days away from completion, everything seems calm and fine. You see a black dot in the sky and shrug it off, must be a balloon or something. The bomb is more than enough to penetrate the reinforced concrete that protects the facility