That's precisely it. And it's been the same reason for the last few decades. The level of security in software won't change significantly until the cost of writing insecure software exceed the costs of writing secure software.