They also see zero reason to spend even a dime on better security of processes when they saw that the entire company could be pwned and distributed on the dark web and you end up losing zero revenue, maybe a million bucks in a class action suit.