It isn’t. Nonprofits don’t have a ton of money, and implementing strong security controls takes money and time away from other activities. Snal businesses have a lot of trouble for the same reason.