I don't buy your observation that all big-corps are kind of equally sloppy security-wise. Here are 2 examples:

  - Equifax login form does not use STS header.
  - equifax.com/business exposes full server version (Server:Apache/2.4.27 (Win64) OpenSSL/1.1.0f mod_log_rotate/1.0.0)

I'm not a security person but those 2 seems way out of industry standards for security-aware web services.