I think it’s even more so a matter of being time-consuming to do correct even if you know what to do... In a microservice architecture. mTLS everywhere, proper PKI, fine-grained access for all users and services, keeping dependencies minimal, vetting updates, securing network, firewall rules, keeping security patches up to date... all this takes time and without strict processes it’s very easy to cut corners.

And what about that PoC that slowly transitioned to bring a production system?

A large part of the blame lies in the culture of pressure on releasing fast and often.