Because they don't know that they care. They only will when they find their credit has been stolen, or their identity. Having security upfront is doing the right thing so that the industry doesn't become overly regulated.