People just assume it won't happen because we assume Facebook has deep security expertise. And we assume Equifax got hacked because they (evidently) didn't.

I don't know whether it's a reasonable assumption or not.