It’s practically criminal how these morons haven’t locked down their systems. I wonder if the problem is that they are operating with a post-Cold War mindset when the Chinese are every bit as aggressive as the Soviets as regards intelligence gathering.
No its mostly ignorance and money. The rules are incredibly complicated forcing them to spend money on useless documentation instead of things which improve security. As a result they look for ways around the rules.
One of my clients with major govt contracts had all of the money for security cut from the contract. So they cut all of their security people and services.