I think the driver is economic: companies are not forced to compensate users for the loss of their private data. Breaches are annoying but essentially harmless

I think the driver is economic: companies are not forced to compensate users for the loss of their private data. Breaches are annoying but essentially harmless for most companies. As such, it doesn't make sense to invest that much in security. Security protects your users, but the privacy and safety of users has zero impact on most companies' bottom line. The situation will continue until compensation of victims (i.e. users) is mandatory by law.