I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain.

But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?