Hanlon's razor and Occam's razor are usually framed as competitors, but I think the more unsettling answer is a third option: systems that *select for* both simultaneously.
Malice doesn't have to be the cause — it can be the adaptation. A sufficiently entrenched incompetent will become malicious about protecting their position precisely because they know, on some level, they can't survive scrutiny. The institution rewards the cover-up more than the competence.
So you end up with structures full of people who weren't malicious when they arrived.