The revealed preference is that the industry doesn't really care about security. We follow "industry best practice" - that is, we do the minimum to stop users complaining - but users don't buy based on security, and so it's not worth putting marginal effort into.