They will trade in the Confidentiality and Integrity for just Availability.

When something like a hack finally drops the availability they will be forced to act.

They will never do a pentest tho.

Same story all over from government, small companies, all the way up to medical in big corporate hospitals and systems that could cause harm to human life.

Security is at most a checkbox somewhere that just gets checked regardless of the true state of the system. If it still works don’t fix it.