It's not only the cost to encrypt something. It's the cost to create security policies, hire people who know the field, implement protections beyond encrypting

It's not only the cost to encrypt something. It's the cost to create security policies, hire people who know the field, implement protections beyond encrypting data at rest, updating old software to deal with the new security measures, etc. It's never as simple as "just encrypt that field". Until there's a good reason to do so people aren't going to bother.