I think everyone is confused because they don't understand Symantec's business model. They're primarily a rent-collecting entity that leverages the requirement

I think everyone is confused because they don't understand Symantec's business model. They're primarily a rent-collecting entity that leverages the requirements of regulating industries like PCI as a way to tax businesses. That why all these simple logical steps to make their product better aren't (and won't be) implemented.