I think that would be the case if the employer was doing this on purpose.

I would bet this is more a case of business goals being met by dev teams in the quickest and easiest way possible, without anyone providing legal or regulatory oversight to ensure the implementation is complying with required laws.

That's not any kind of justification or excuse though!