It's been established that security itself does not increase revenue nor make the quarterly returns look good. Unless there's an incentive for key stakeholders to spend more resources to strengthen the security of their deliverables, it is unlikely for things to change in the near future.

Perhaps a change in KPI or regulation requirements may create such incentive to ensure appropriate actions are taken.