I think you get what you pay for in security, and it's clear that a lot of the c-suite are happy to pay to tick boxes... so you get a lot of going through the motions.

Also, this isn't really new. When I worked as a more Junior person about a decade ago, lots of decisions came down to what was cheaper or faster, not what was secure.

To have good security, it's a cultural and organizational thing where the people at the top have to be on board.