Well, until companies and executives can be charged with criminal negligence for refusing to follow either the advice of their own engineers or standard practic

Well, until companies and executives can be charged with criminal negligence for refusing to follow either the advice of their own engineers or standard practices, its cheaper to let the data be stolen and deal with the fallout than it is to deal with building actual security, so you can presume off-hand that the information you provide is not going to be secure if it is retained by them. Assurance that your connection is not being intercepted and at least the transport is secure from your end to theirs, even if it gives no assurance of who they are, is at least a protection against nibshit spies like the NSA. (Until they convince ISPs to install BlueCoat boxes which wouldn't surprise me.)