Why do cyber security architecture models almost never appear alone in a real system?

Because real systems have grown over time and keep changing, so in practice you almost always find a combination of several models: combined deliberately to join their advantages or increase coverage, or combined badly because fragments were added over the years.

The environment of applied CSA has two features:

• Grown structures: old legacy systems, systems in the own data centre, the most modern cloud services, all connected via the internet.
• Continuous development: technologies and systems, attack methods, and CSA itself keep evolving.

So the CSA models are not single design patterns to apply in isolation. Combinations happen for good reasons (to combine advantages or raise the degree of coverage) and for bad ones: because IT systems grow over long periods and models or fragments of them are put together unfavourably, you will also meet unfavourable combinations.