That's, probably, because most (IMHO) sites are hacked "live", by modifying code right on the production server. And there're no automated testing involved, at

That's, probably, because most (IMHO) sites are hacked "live", by modifying code right on the production server. And there're no automated testing involved, at all. With proper development process (with development->staging->production cycle), and fair tests coverage, there shouldn't be any problems with strict XHTML validation. Except for human laziness (I'm guilty too, of course) and lack of easy-to-use "here, install this toy, fill in this five-line config and deploy with just one command" tools.