I'm not so sure we do disagree :) At the risk of splitting hairs... there are costs associated with finding developers who have this education and/or fostering

I'm not so sure we do disagree :) At the risk of splitting hairs... there are costs associated with finding developers who have this education and/or fostering a company culture where security best practices are important. If software companies were seriously punished for compromising PII, then I imagine we'd see a change.