I’m going to guess they’re companies without software expertise in house, so nobody to review the code anyway.

If companies continue hiring people like this, it’s only a matter of time before the exploits roll out.