This is why Managers and PMs should not be deciding priority of security betterments. I've never worked at, or heard of, a company that adequately incentivizes

This is why Managers and PMs should not be deciding priority of security betterments. I've never worked at, or heard of, a company that adequately incentivizes or takes posthoc corrective actions for EMs/PMs around long term consequences or brand threats. They're tragedies of the commons of sorts.