That's my next point. Absolutely. Overclassification is an epidemic within the Canadian government and other governments, too. We are by no means unique in this regard.
Another reason is, notably, the risk-averse culture, where—I'm simplifying this massively—you get penalized for mistakenly releasing information that shouldn't have been, whereas you don't get penalized for overclassifying any. So the incentive system is completely tilted in that direction.
Also, there can be a lack of clarity. It's one thing to tell employees of CSIS, the Canadian Security Intelligence Service, or the RCMP to be transparent, but what does that mean in practice? Under whose authority must they be transparent? What do we say? What don't we say? Are you protected by your bosses? Are you protected by politics? Sometimes, it's not the bureaucracy that shows resistance, but rather the political milieu, not for security reasons, but to avoid the political embarrassment to which disclosure of information could lead.
The question you raise is therefore extremely important, and is at the heart of all debates on transparency. In several respects, there is the cultural aspect and there is the aspect linked to the authorities in place.