It's always difficult to assess these kinds of decisions without all the information, though. There might have been very good business reasons for this. Maybe

It's always difficult to assess these kinds of decisions without all the information, though. There might have been very good business reasons for this. Maybe to qualify for the insurance cover for intrusion, there was a specific list of algorithms that the insurance company said had to be used. Maybe it costs the insurance company so much to update its actuarial model for the policy that it's only worth doing every 10 years even if that means it's less secure. I'm not saying that this is true for this case. But it could be.