They absolutely eo completely ignore many security and privacy things because they're very selective in what they focus on, particularly around how those things might impact their ad revenue.

How much they spend is no indicator of how and where they spend it, so is hardly a compelling argument.