Big G is driven by money like any other company, but they lose more money if they don't employ top security practices and prevent others from getting their data. ATT's main business isn't selling the data, it's selling the pipes that carry data, so security on their data lakes is probably less of a priority.

> ATT's main business isn't selling the data, it's selling the pipes that carry data

... and I'm sure their shareholders are pressing them to forego the greater revenue from subscriber data so they can keep their dividend cheques comfortably small.

With the SPs, all you have to do is look at ANYTHING security related around their business and observe what shambles it is.

The last time I looked, the csrf token issued by the homepage of one of the big three mobile carriers was "undefined."

This. I know from experience how terrible a company they are with customer service, but there is that little arrangement with the NSA called PRISM...