A local company with bad security practices does not, at its core, make money by collecting user data. The collection of that data and the security or insecurit

A local company with bad security practices does not, at its core, make money by collecting user data. The collection of that data and the security or insecurity of its storage is pretty much orthogonal to the central business of every company in the world except for tech companies that sell consumer data. Hence, the dictum "don't ascribe malice where incompetence would suffice" doesn't carry across these two different classes of organizations.