It's not a priority until it affects customers enough to seriously harm their bottom line. Even if it cost them 10% in sales they are still saving money since

It's not a priority until it affects customers enough to seriously harm their bottom line. Even if it cost them 10% in sales they are still saving money since having solid security would cost way more and take more of the little time they have to bring the product to market.