There are certainly people that don't care about security out there, but the biggest issue is just how much people are expected to know.

Docker, AWS, Kubernetes, some wrapper they've put around Kubernetes, a bunch of monitoring tools, etc.

And none of it will be their main job, so they'll just try to get something working by copying a working example, or reading a tutorial.