[rtempaccount1]

The last point is the one that really rings out to me as an Info/IT Security person.

While these incentives aren't aligned it is unlikely there will be a significant improvement in overall IT Security practice.

It's been proven time and again that the optimal approach for organizations is "move fast" and worry about security later.

Of course the problem from a societal standpoint is that there are externalities there, so the entities suffering from the consequences of this mismatch of incentives aren't the same as the entities making the money out of it.