Would this kind of attitude by an organisation incentivise malicious/nefarious activities? Is it because if actual funds are stolen they'd be covered by insuran

Would this kind of attitude by an organisation incentivise malicious/nefarious activities? Is it because if actual funds are stolen they'd be covered by insurance and could leverage law enforcement, but open security research may just cause extra internal costs?