No its mostly ignorance and money. The rules are incredibly complicated forcing them to spend money on useless documentation instead of things which improve security. As a result they look for ways around the rules.
One of my clients with major govt contracts had all of the money for security cut from the contract. So they cut all of their security people and services.
Facepalm.