They chose to use a framework without understanding the implications of its security issues. When one comes up, they tell their users it's someone else's proble

They chose to use a framework without understanding the implications of its security issues. When one comes up, they tell their users it's someone else's problem. Maybe they're an impoverished company that can't afford to pay to solve the problem. Or they dont care much.