It's not just apathy, it's also because there's often so much you can do without pissing off the management or generally looking like a "bad culture fit". And then they'll get someone else to do it anyway.

At my current job, I don't have any privacy-related issues, but I have to handle occasional clueless ideas from the customer. It usually goes like this:

  They: We want to have this security-related change X.
  Me:   Uh ok... but are you sure it's a good idea? What's your threat model?
  They: ???
  Me:   You see, this change will make it more difficult for user to do Y, with no real
        benefit to security, because A, B and C.
  They: Uh... yes, you're right; let's not do it then.

Fast-forward one or two other attempts at proposing the same change and half a year later, I find the change implemented in the codebase anyway. Turns out some other manager on customer's side asked someone else in my company to implement it.

-.-