Most non-tech companies don't have an IT department, they outsource.

Which means they rely on those companies to do the right thing, while not really prioritizing the work (i.e. not giving it much budget), or being able to critically evaluate the quality of the work being done.

So none of this is surprising.