It's because they don't. Two things I've found in less than a year of working in the security industry is that people only care if things work, not if they work

It's because they don't. Two things I've found in less than a year of working in the security industry is that people only care if things work, not if they work well and, that they either believe security can be delegated or that they will never be attacked because they're special in some way.