> while they don’t care personally whether the site is vulnerable - otherwise they wouldn’t have let such a basic vulnerability slip through

Even if they do care personally (which I would assume is often the case if the respect person is not an ignorant careerist), they often don't have the

- organizational power

- (office-)political backing

- necessary very qualified workforce

to be capable of deeply analyzing every line of code that gets deployed. :-(