Not all websites are created with IT in the loop. And sometimes even if IT is in the loop, then they aren't privacy/security conscious enough.

I got to see this first-hand being part of a marketing department. IT was explicitly left out of the loop. Though that was a Fortune 500 company. I'm not saying it's the same situation for the organization of this article.

My point simply is: IT is not always in the loop when a site gets created. And I bet "not always" is putting it mildly.

Tribalism is a thing. Or at least, I call it tribalism.

"Show me the incentive and I'll show you the outcome". It's that kind of stuff, unfortunately.