That's fine: it doesn't suit their needs. No protocol is meant to be all things to all people, and every organisation has its own security posture and its own e

That's fine: it doesn't suit their needs. No protocol is meant to be all things to all people, and every organisation has its own security posture and its own environment. I don't think any of that entails that FTP is somehow failing to fulfil its contract. Implementing transport encryption is not within its scope. It has to be run over a secure channel, which can easily be done with FTPS.