Here is an example from my career: I once found a SQL injection at a large internet company (I won't say which one) that dumped user accounts including hashed passwords, email addresses, comment history, and a ton of even more sensitive data. The management of this company did the math and said the risk of someone maybe finding it vs the cost of the dev team missing a feature deadline made the vulnerability less important to fix. The sad part is that they were proved correct. The dev team finished the feature and then merged in my fix for the injection (it was a relatively large fix involving a large constructed SQL statement and I wrote it in my off hours because I couldn't just leave it). No one found the issue and the feature landed them new business. In the end they got what they wanted, the fix and the new business, because I gave up extra hours. That's when I decided that app development better suited me.

Depends.

Security flaws are not created the same. Mostly they are hypothetical. A buffer can over flow and smash the stack, but what then?

A security flaw that costs a million dollars to find and has very little chance of being actually used is not worth finding. But when you start looking, you do ot what you will find.

Like most things, ity is a trade off