"out of proportion to SSL/TLS’s place in our business" is an insane comparison. They are saying they care so little about SSL/TLS to begin with that it's not fair.

It would be like me practicing surgery 1 hour a week and saying "well surgery only has a very small place in my 80-hour work week" in response to flagrant failure of medical care.

"We are bad at this job, but we don't do it often so don't think we are bad at other jobs".

Yeah, the proportion if anything is too small. This is the sort of company that should not be doing anything related to security.