The reality is, for a lot of people, they do not care about risk or implication or cost, as so long as they see things moving forward, especially if they do not understand what they are dealing with. The desire of 'build, build, build', to these people does not have a downside because they do not have the knowledge of what the implications of that actually means nor is there a culture associated with the duty of care that should come with the liability associated with other people's data.

Also, small business contracts likely do not have the same type of language around indemnity/SLAs, so it is easier for the harms of this type of system to go unpunished because those who are harmed are even less knowledgeable.