Security, features, and speed of development all tend to be at odds with each other. And the major problem is: security doesn't gain money. The others do. Security is pure risk management.

So it will almost always get the backburner. Hell even if there are financial consequences: those don't matter if you don't really make money in the first place.