And this is clearly demonstrated by massively critical vulnerabilities found just in this year in products such as Microsoft, Solar Winds, F5, all highly respected software vendors used for mission-critical business operations.
Security only becomes a topic when there's 1) a regulatory requirement, 2) there's an angry customer who was breached.