In many cases, I’d say it’s because they aren’t IT or IT Security focused businesses. A pizza shop, clothing retailer, or whatnot, needs IT stuff to function, but that’s not the focus of their business. Hiring an IT team at IT worker rates is expensive, especially as a support/tertiary role for your business.