When it comes to security, you run into IT departments being the red headed step children of the corporation and NIMBY (not in my backyard). It's a lot easier and cheaper to stick your head in the sand and pretend nothing is happening or you have some mitigating factor that discourages people from going after you be it size (miniscule for instance), participating in a niche market, etc. It's a lot easier and cheaper to do an ostrich than actually spend the money on decent security.