Why do cyber security architecture models almost never appear alone in a real system?

Because real systems have grown over time and keep changing, so in practice you almost always find a combination of several models: combined deliberately to join their advantages or increase coverage, or combined badly because fragments were added over the years.

* Grown structures and constant change make a mix of models the normal case, for good reasons or by accident. *

The environment of applied CSA has two features:

• Grown structures: old legacy systems, systems in the own data centre, the most modern cloud services, all connected via the internet.
• Continuous development: technologies and systems, attack methods, and CSA itself keep evolving.

So the CSA models are not single design patterns to apply in isolation. Combinations happen for good reasons (to combine advantages or raise the degree of coverage) and for bad ones: because IT systems grow over long periods and models or fragments of them are put together unfavourably, you will also meet unfavourable combinations.

Go deeper:

• Defense in depth (computing) — Wikipedia — layering several controls on purpose, the good kind of combination.
• Legacy system — Wikipedia — why old systems stay in place and end up joined to new ones.