Yes but it tends to be around bigger companies. Lots of smaller businesses just don't care. They also don't have "chief somethings" to tell them it's important

Yes but it tends to be around bigger companies. Lots of smaller businesses just don't care. They also don't have "chief somethings" to tell them it's important, or to do it to save their own asses just in case. They just fly blind and in many cases they get lucky which further solidifies their beliefs. And in the odd case when they get screwed they just bury it and move on. Or post a "we are very sorry! security is our TOP PRIORITY!" message somewhere and move on. I mean just look at the Equifax fiasco. Then scale that down to the smaller companies and see what you end up with...