IT is a cost center to them and they want to build/maintain their software as cheaply as possible. Short term it's cheaper to sweep this under the rug than to actually build a culture where security and best practices are important. Long term it doesn't matter because the senior management will have moved on.