>They knowingly ignored basic security practices to maximize gain. Never assume malicious action when inaction gives the same results. It's more likely that t

>They knowingly ignored basic security practices to maximize gain. Never assume malicious action when inaction gives the same results. It's more likely that the Struts vulnerability was not addressed because it would require development time and effort for a stable, functional system and all resources were dedicated to new features. That's pretty much the default mode in any company without management emphasis to change priorities.