More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).

Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).