A lot of the posted examples include basic copy/paste blocking and password rules. The barrier to better security in these reports is so low as to be non-existent. The better question is why these companies can't even do that, let alone aim higher when they are at the size they are in a world where everything is digital.