Why does vaccine development take so long?

While it is true that deactivated (e.g. heat killed viruses) are used in some cases, the Pfizer, Moderna vaccines are in fact mRNA vaccines. The figure below from the Oxford website details the processes involved in vaccine their DNA based vaccine development. This Moderna page has a video detailing their approach as well. Pfizer also has a nice video explaining the process of mRNA vaccine development.
As you can see, it is not an easy process. A prerequisite of both their solutions is the knowledge of the SARS-CoV-2 genome sequence (in this case the genome is a single stranded RNA). This requires some time to get done and once the data is available, one has to wait for others to verify it to some extent. Interestingly, the Moderna video says that they had a human ready vaccine in 42 days.

The differences in efficiency can stem from multiple factors:

1. What vector is used to deliver the vaccine
2. How the mRNA is tweaked to produce Spike glycoprotein
3. Physiology of the individuals receiving the vaccine

and many other factors which are beyond the scope of a single answer and can be proprietary knowledge of the manufacturers.

Another significant addition to the 'time' factor is the clinical trials. Pfizer and Moderna require two doses spaced over 3-4 weeks for their phase-I trials. Since these vaccines are being rapidly developed, and you are amidst a global pandemic, you get only 1 chance at a clinical trial (and subsequent profits) and you have to make it count. Various national regulatory authorities also need to keep the health of their citizens in mind. Thus there is immense pressure to get these trials done right and the global consensus in this case seems to be taking a slightly long duration of clinical testing.

Regarding the last question, no, none of the Oxford, Pfizer or Moderna vaccines care about damage done to the original pathogen because there is no pathogen being delivered.

Roni Saiba's answer does a good job of explaining what goes into current vaccine development and why it takes so much effort, but I want to directly address the question of why we can't just grow some virus, kill it with UV and have a protective vaccine.

The answer is that not all immune responses to viral antigens are helpful in fighting infections of that virus. In some cases it can be harmful; antibodies to dengue virus of one serotype will attach to viral particles of another serotype but aren't able to inactivate them. The attachment of antibodies to active viruses makes their absorption by cells more efficient, and infections where this antibody-dependent enhancement occurs are more severe than first-time dengue infections.

Some viruses have evolved mechanisms to capitalize on this. The reason we need to get a new flu shot every year is that influenza viruses present a "knob" at the end of their glycoprotein that can change its structure and still retain function. This part is much more 'visible' to the immune system than parts of the virus that can't tolerate changes, so the immune response to this variable part outcompetes and prevents an immune response that would provide long-lasting protection. Conserved stalk-targeting vaccines are being intensely investigated for this reason. SARS-CoV-2 may have a immune-faking mechanism as well: the "spike" glycoproteins responsible for binding the ACE2 receptor and entering the cell convert to their post-binding form prematurely part of the time. Antibodies that bind the "post-fusion" form of the protein don't inactivate the virus, and this form sticks out more so may serve to compete for immune attention with the pre-fusion form that would provide protection if bound by antibodies.

In this last example, we can see that a vaccine made of killed SARS-CoV-2 virus particles would be useless if all of the spike proteins had converted to the post-fusion state. The mRNA vaccines therefore don't encode the natural spike protein, but a mutated version which can't convert to the post fusion state as easily:

S-2P is stabilized in its prefusion conformation by two consecutive proline substitutions at amino acid positions 986 and 987

In conclusion, viruses and the immune system are very complicated. Simple vaccines work for some viruses, and don't work for others. When they don't work, the reason is always different, but hopefully I've communicated some general understanding of the background issues.

EDITS: This doesn't relate to the rest of my answer but I want to respond to Ilmari Karonen's and there is not enough room in a comment.

Looking at the timeline for SARS-CoV-2 vaccine development gives a very misleading impression of how long it takes generally. This is because ~90% of the development work was already done before COVID-19 was ever identified, in the 18 years since the SARS-CoV-1 outbreak started in 2002. Vaccines against SARS were developed and tested up to phase I trials, but couldn't proceed further since the virus was eliminated. I discussed this in a previous answer to a similar question, but to expand/reformat, here's some of what we knew and had available on March 17th 2020, when the "covid vaccine timeline" begins:

1. Identified the receptor as ACE2, and knew that antibodies targeting the receptor binding domain (RBD) of the spike protein neutralize the virus. Protocols to test that these were also true of SARS-CoV-2 were already developed and validated. Without this there would have been a lot more trial-and-error experimentation and false starts with vaccine candidates that looked promising but didn't pan out in testing.
2. Animal models. There is no naturally-occurring model organism for COVID-19. This is a subtle point because other animals can be infected with the virus, and some develop morbidities because of it. However, these are different enough from what we see in humans that something that protects against the reactions we see in the animal can't be assumed to protect against the reactions that cause problems in humans. For SARS, researchers developed transgenic mice that used the human version of ACE2, and showed that the disease they got from SARS were analogous to the disease humans got. This took several years, and the colony was still available when the virus causing the outbreak in Wuhan was identified as SARS-like and researchers started looking for animal models. As an aside, in an interview on This Week in Virology that I can't find right now, one of the maintainers of that colony said they were months or weeks away from shutting it down and euthanizing all the transgenic mice when the pandemic began, so if funding had been just a bit tighter we probably would not be having this particular conversation now.
3. How to stabilize the pre-fusion form of coronavirus spike proteins had been determined from work on SARS and MERS vaccines.

In addition to these, a large amount of miscellaneous knowledge about coronavirus functions and the immune reactions to them had been accumulated, and this sped up development, and increased confidence in results, which allows vaccine candidate production and testing to proceed more aggressively.

Historically, vaccine development has taken years or decades of research after the need has been identified. Testing is still longer in many cases, but the current case is very unusual.

While the existing answers are great and cover a lot of the difficulties in vaccine development, I feel that they fail to address (or at least sufficiently emphasize) the fundamental misconception at the core of the question:

If that's the case, why does it take so much time and effort to develop a vaccine, for example, against covid-19?

The answer to that question is simple: developing a vaccine does not take much time. What takes a lot of time is testing the vaccine and making sure that it does not have any unforeseen side effects.

For example, let's take a look at the Pfizer/BioNTech COVID-19 vaccine, since it's been in the news lately. To save time and research effort, I googled for "pfizer covid vaccine timeline" and found this article from Financial Review, whose timeline I will further summarise below:

• March 17, 2020: Plans to develop the vaccine are announced.
• April 29, 2020 (six weeks later): First tests on human volunteers begin. At this point the vaccine development is essentially done, and the vaccine has presumably also already passed initial tests using in vitro cell cultures and animal test subjects to ensure that it at least seems to be doing something and doesn't have any obviously bad side effects. (The first human trials are done with four different variants of the vaccine, because the developers obviously want to minimize the risk of having to start over from scratch in case one specific variant turns out to be ineffective or dangerous.)
• July 1, 2020 (two months later): Preliminary results from the first human tests are announced. One particularly promising candidate vaccine out of the four initial variants is chosen for further testing.
• December 2, 2020 (five months later): The UK is the first country to approve the vaccine for use through a "rolling review" system, which allows a novel vaccine to be temporarily approved for emergency use in an epidemic even while it still undergoes further testing. Requests for similar emergency use authorizations are currently under review in other countries, including the US and Canada.

So, basically, even under this extremely accelerated emergency testing and approval regime (which squeezed into months what would normally take years), the actual development of the vaccine took less than 20% of the total time from initial planning to approval. All the rest is just testing, testing and more testing.

Now, the other answers have already covered pretty well the reasons why all this testing is needed, but let me anyway give a quick summary for completeness:

• Vaccines intended for humans need to be tested in humans, because that's the only way to be sure that they work and are safe to use for humans. Cell cultures and animal models can never give a fully accurate picture of how the vaccine will interact with the complete immune system in a real human body.

• Because all human bodies are different, any new vaccine (or other medical treatment) needs to be tested with as many different people as possible, with as many different ages, ethnic backgrounds, pre-existing conditions, etc. as possible, to make sure that there are no harmful side effects that only show up in a small subset of the population.

• Also, when testing a vaccine, one of the most important things that need to be confirmed is that it actually prevents the disease. But since it would be grossly unethical to deliberately expose test subjects to a dangerous infection, the only way to test that is to vaccinate a lot of volunteer test subjects and wait for some of them to get naturally exposed to the disease (and then compare the vaccinated test subjects with an unvaccinated control group). This waiting takes time, and since (for most diseases) most of the test subjects will never get exposed and infected anyway, it means that a lot more subjects are needed.

• Because human testing in inherently risky (but necessary), nobody wants to take the unnecessary risk of administering a completely untested vaccine to a large number of people. But a large number of people still need to be tested to confirm that the vaccine is safe for everyone. Because of this, testing is invariably carried out in multiple phases: first with just a small number of volunteers, then (if no severe issues show up in the initial tests) with a slightly larger group, and then with an even larger group, and so on. But since each new phase can only be started after sufficient data has been collected from the previous phase, this multiplies the already long duration of the testing by several times.

FWIW, most of the same issues apply to all new medical treatments, not just to vaccines. New drug development and testing is also notoriously slow and expensive for pretty much the same reasons — and even then there are plenty of cases where major side effects were only discovered when the drug was already on the market.

One issue that does specifically affect vaccines is that they're preventative treatments that must be administered to a large fraction of the healthy population, not just to already infected people. (Even only vaccinating specific groups at high risk isn't generally sufficient to provide herd immunity.) This means that their safety needs to be tested to a significantly higher standard (since many more people will be receiving the vaccine) and that, as noted above, determining their efficacy requires a must larger pool of test subjects (since not all subjects will be exposed to the disease).

Anyway, the upshot of all this is that if it weren't for all this testing and re-testing, we could've had a COVID-19 vaccine in April, or maybe earlier. (Moderna started their vaccine development already in January, and their first human trials in March.) But even in the face of a global pandemic, the testing is still necessary to make sure that the vaccines that eventually do get approved and widely used will in fact do what they're supposed to do, and that any side effects they may have don't turn out to be worse than the infections they prevent.

---

BTW, this need for extensive human testing to confirm the safety and effectiveness of a vaccine even after it has been developed is not just the reason why even one company will often develop multiple initial vaccine candidates in parallel, but also one of the main reasons (besides simply capitalism) why there are so many different competing vaccines being developed by different companies. Basically, even the companies that were late to start their vaccine development and testing could, for a long time, still hope to be the first ones to market if testing happened to turn up serious issues with their competitors' vaccines.

Of course, other reasons exist too: the second, third, fourth etc. companies to get their vaccine approved can also expect to win a decent share of the market, especially if their vaccine happens to be cheaper, more effective and/or easier to store and transport than the alternatives. Also, many countries may prefer to use a locally developed and produced vaccine if one is available in order to limit their dependence on foreign suppliers.