What is the incentive exactly? What do they really gain by having such crappy security practices, other than just not having to spend the time and money to impr

What is the incentive exactly? What do they really gain by having such crappy security practices, other than just not having to spend the time and money to improve security?