I mean, most companies have security last on their budget list.

It tells more about human nature than about a company.

This can only be fixed systemically by huge fines and/or imprisonment. Otherwise the temptation of taking the risk to neglect security is too strong.