I think part of it is that there's also not that many hackers actually using exploits. Sure, there are automated stuff like botnets, but there seems to be little manual hacking done. Chances are, if you have lousy security, you're still not going to get hacked (unless you're literally holding money, or have blueprints of military hardware). If this is correct, it means that security is usually a waste of time.

I really care about security, but I think it's mostly because the aesthetics of insecure code bothers me, and not because of a carefully considered cost-benefit analysis.