the easy explanation is that the cost of a breach is externalized, so decision makers gain benefit from savings in not investing in security.

Look at the crowdstrike failure as a recent example, but there's plenty more in the past.