Those teams are pretty motivated to protect users as well, because user population and network effects are key to their business models (perhaps a bit more for Facebook than for Google but still). If users started feeling like visiting those sites exposed them to security risks, as well as the existing privacy concerns, it would be disastrous for the bottom line.