Don't attribute to malace what can be attributed to ignorance. What's more likely? High profile private organizations thinly veil their shoddy secruity measures hoping to never be exposed, or high profile private organizations erroneously believe their systems to be robustly secure?

I'll take the latter.