The issue is often that: 1. The vendor is not aware that this is a problem 2. As a result of point 1, the vendor does not have budget planned for this. 3. The

The issue is often that: 1. The vendor is not aware that this is a problem 2. As a result of point 1, the vendor does not have budget planned for this. 3. The reward for the investment does not make sense for most of the vendors. About point 3: For the vendor, there is no tangible improvement in sales (in fact, some security measures raise the barrier for their customers to place an order). So why should they do it? In their experience, the budget is better spent on improving the customer experience, marketing, increasing stock, lowering prices, etc. Point 3 is really tricky, especially in some cultures and countries. If there is no legal consequence for leaking customer data, why should they be spending money on preventing something that may or may not happen in the future?