Same as anywhere else. Complacency, lax auditing, temporary fixes which are in place for years, non-technical people making technical decisions (choosing convenience over security, generally).