Imagine a world where there is no, say, AWS. So many basic security things that we take for granted are automatically set up for you in the cloud, as most shops out there could not care for it to save their own lives.

Companies that torch through millions of dollars of VC money need a nice ransomeware kick in the ass to set up a MongoDB password, and will proactively ignore S3 warnings to not make something public, so what do you expect?