[caust1c]

Blame society. Businesses won't value security unless the fear of getting attacked is sufficiently strong and the losses significant. Otherwise why invest in it at all?

Definitely not just hardware exploits though. Look at heartbleed for example. It's been going on a long time. Hardware exploits are just so much more widely applicable hence the interest to researchers.

[nicce]

It also feels like that people who are highly determined to build high quality, secure software are not valued that much.

It is difficult to prove their effort. One security-related bug removes everything, even if it happened only once in 10 years in 1 million line code base.