There are ways to combat that. For example, some clear processes and documentation. This will help many other issues in organizations as well. Someone can have security as part of their KPI. That will put a focus on it.