Building applications is a complex problem. If you want a secure system, then security details have to be carefully considered at every layer (DB, API, front-end). Doing that requires expert security employees/consultants, time and money. On the other hand, profits are driven by new features, first to market and sales.<p>Companies can build insecure systems (that are profitable) much faster and much cheaper than they can build systems that are profitable <i>and</i> secure.<p>It has been my experience that security is seen as a <i>necessary evil</i>. It's not seen as a benefit or feature that customers want. Security employees/consultants are often seen as road-blocks or obstructionists. I think this is largely why technical security has been replaced by compliance. Just check the box mentality. When they get hacked they can say, <i>"but we were compliant and we'll do better next time"</i>.<p>IMPO, that basic conflict explains why systems are repeatedly compromised and why companies nor customers really care about good technical security.