I wasn't really saying it in jest. The ";)" was more of an "oh, the horror" signifier, meaning I don't really think it's great that the cost-benefit analysis here is so short-sighted.

Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action.

Bureaucracies do not take visionary action. They stay the course.