If you've ever worked in the safety industry, it's not all that different. When it comes to safety features, compliance, and training, most companies take the same approach at meeting minimum legal requirements and passing liability wherever they can for cost savings. If they can cut corners and not hurt profit margins, they will gamble.

If businesses tend to ignore safety and gamble with respect to human life (in scenarios where it results in net cost savings), I have no remote disillusionment that they'll care about data security in cases human life isn't at risk (again, unless it's shown to reduce overall costs and convince management of that).