There's very little, if any, incentive to do anything more securely than absolutely necessary. It is only a problem, when it is a problem and is treated that way in nearly every org I've worked in.

> There's very little, if any, incentive to do anything more securely than absolutely necessary.

There wasn't.