It takes exceptionally determined individuals and considerable effort to build and setup software and systems that deviate from mainstream "best-practices", for

It takes exceptionally determined individuals and considerable effort to build and setup software and systems that deviate from mainstream "best-practices", for example to keep your data actually safe (in every sense of the word) long-term. These companies probably have their hands full solving their domain problems and running a business. Security is not mentioned as a main selling point on their respective websites. Without a higher public awareness of data security, severe punishment for any breaches and failures to keep data safe, and a software ecosystem that prioritizes security much higher I feel you are right expecting the worst.