I think it is natural for engineers (hackers, especially) to deal with situations on an as-needed basis. We just solve problems. We make at least SOME effort to

I think it is natural for engineers (hackers, especially) to deal with situations on an as-needed basis. We just solve problems. We make at least SOME effort to solve them in such a way where they won't continually come back and bite us in the ass but security catastrophes are like earthquakes. They're low frequency events and therefore inherently difficult to learn from and plan for. It's possible but time consuming, so the average lone hacker will not bother until he absolutely must. We know it's important. It's in the back of our mind at all times. But shipping product and getting users NOW will always take precedence over architecting for the future, methinks. And that is just the unfortunate reality for now until (heaven forbid) there are some actual laws preventing it.