It's a lot simpler than you're making it: PMs don't want to pay for those things. If you tell them what tests are, they will say that's a waste of time and we

It's a lot simpler than you're making it: PMs don't want to pay for those things. If you tell them what tests are, they will say that's a waste of time and we need to ship features. If you tell them there's a huge security vulnerability that will take 15 hours to fix, they will get vaguely angry with you in a way that directs you to another task, to avoid explicitly saying "we're not working on security." They are very good at this malicious misdirection. Their goal is to not understand their own liability and make it your choice to work overtime for free. I'm dealing with this right now, a company with multiple data breaches who is trying to blame us, the new guys, for a breach that happened before we joined the project. They refuse to notify their customers because they "don't know how much data was leaked" (because they turned off the logs to save money). They have been so disgustingly negligent through this process I am considering leaving my job just to not deal with this one client. There are developers that don't care, but many that do. And they have stories similar to mine. They are told not to care by managers. I've never met a good PM. I'm sure they are out there, but I'm convinced this position is a magnet for the scummiest snake oil salesman on the planet.