But what about the companies making millions in profit each year that are carelessly exposing sensitive data because they don't want to spend a little more on quality IT work?

No one wants to see their local pizza shop lose their pizza-credit database, but if that's the price to pay for data security then so be it.