Getting them right is very tricky and small, subtle flaws can produce output that looks like it is working but offers protection that is nowhere near as strong as that offered by a proper implementation. (A good example of this is the CSS encryption scheme deployed on DVDs; flaws in that custom algorithm reduce its effectiveness considerably.)