There is no system in use by a commercial entity in the world that can stop criminals with ~10 M$ from completely bypassing all of their security and doing arbi

There is no system in use by a commercial entity in the world that can stop criminals with ~10 M$ from completely bypassing all of their security and doing arbitrary amounts of damage. If the attackers can on average derive more than 10 M$ of return, then you are guaranteed profitable to hit. For instance, in the 2023 casino hacks of MGM and Caesars, Caesar paid a random of ~15 M$, making them profitable. In the JLR hack, JLR has incurred ~500 M$ of damage to date. These attacks cost less than 10 M$ to create and deploy guaranteed. However, most commercial systems are vastly easier to hit than even 10 M$. I would venture that most of these high profile attacks are on the order of merely ~10-100 K$ to actually create and deploy making them wildly profitable with a ROI in the 10-1000(!) range. And, if you have the choice of spending 100K to get 15 M$ or 10 M$ to get 15 M$, it is pretty obvious who you would prioritize. It is like the story of two people and the hungry bear. Even if you can not outrun the bear, if you can outrun the other person then the bear will tear you apart second. So it is both. Everything is shoddy. Some are dramatically more shoddy than others. And the hungry bears are breeding so they can eat all the dodos.