It's probably a result of the early days of the internet. Nobody knows we have this network, and we have passwords after all so we're good. On top of that base, the contracts that built these systems probably didn't specify much in the way of security.

Even with the recent OPM breaches, probably nobody thinks it's their problem, and weak contracts are probably still being bid.