There does exist a world. It's a world of calculated risks, where people figure out how far they can push things before the risks start eating into profits.

It's the same thing that occurs with risk analysis using customer data. They only fund exactly as much security as they need. Does the company benefit from having private data leaked? Not particularly, but if the cost of having data leaked is less than the cost of securing that data, then businesses will not secure their data.

Which is where regulations come in.