If a short-term-thinking decision-maker has a KPI for low vulnerabilities, they'd rather take the chance of a massive compromise of the company, than to have vulnerabilities reported and definitely hurt their bonus/promotion?