Perhaps they don't have enough of an incentive to make it bullet proof. That or they aren't given enough time to do so. Let's admit it, we all make mistakes, and if you aren't given enough time to analyze your code, security issues might very well make it into production.