Overconfidence perhaps, and an overreliance on shields? Or maybe just because the plot requires an assailable weak point. Although more in-universe:
<PERSON>'s Death Star
Didn't really have any vital components on the outside. Only careful analysis of stolen internal schematics led to the discovery of the weak point, and it could only be successfully attacked by making a one-in-a-million shot that even the X-wing's built-in targeting computer cannot pull off. And although the exhaust port was externally exposed, a successful shot needed to travel all the way down the exhaust shaft into the core of the base to be effective.
The remarks of the Imperial officer ("We've analyzed their attack, sir, and there is a danger") imply that the weakness is something that they weren't previously aware of. His reaction is more "wow, their attack might actually work" as opposed to "well of course they're attacking that, it's the obvious way to make the entire base explode and we knew about it all along", so the weakness could plausibly be chalked up to something as simple as "this is our first attempt at designing a Death Star".
The Second Death Star
Was never completed, though presumably if it had been it would not have had the same weakness. 963
Of course if you get attacked when half your superstructure is completely missing, it kind of doesn't matter where the vitals are.
Starkiller Base
Was constructed relatively hastily, and by an organization with far fewer resources than the Galactic Empire had at its peak. And it did seem like the vital component had been hardened against attack, as
! repeated bombing runs have little to no effect until detonations on the insider tear open a hole in the outer shell; and even then a fighter still has to fly into the hole in order to finally destroy the thing.
Further, the component in question is described as a "thermal oscillator", which seems like it would have something to do with heat-exchange (as would the Death Star's "thermal exhaust port"). Heat-exchangers don't work well if you bury them deep in the ground and encase them in millions of tons of reinforced concrete, or otherwise don't allow them any sort of interface with the outside environment. So in addition to cost/time constraints, there may have been issues related to design practicality that made extensively fortifying the thermal oscillator unworkable.
To function as a heat-exchanger, it needs to have at least some components externally exposed. And disabling the external bits would cripple its ability to function as a heat exchanger, eventually leading to
! catastrophic thermal runaway.
So I think you've got a dose of overconfidence (they don't expect to be attacked, don't consider the possibility of attackers infiltrating their own bases, rely heavily upon shields without setting up redundant shield emitters, etc.) plus the fact that the Achilles heel of superweapons in the Star Wars universe seems to be that they need to dissipate a lot of heat (and very bad things happen if they can't). 963