I don't think it's that conscious, it's just that the cost of preventing such incidents is perceived to be greater than the cost of responding to them after the

I don't think it's that conscious, it's just that the cost of preventing such incidents is perceived to be greater than the cost of responding to them after the fact. It's worked quite well for Microsoft, Oracle and others to be reactive rather than preventive. And as I pointed out above, there are incentives for that sort of behavior that do exist.