Capitalism. They just bought the cheapest reliable enough option they could find and didn’t give two craps about infosec, because that’s too expensive to actually properly do. Minimize the financial losses of an upfront purchase. (I worked more than enough jobs in hardware design to know what management cares about and what it doesn’t)

Also, big yikes for the Israel flag in your username.

Suppliers lie.

I know a guy who is the sole reason that software written by <adversary> isnt being currently used in <host countries most top secret defense environment>. His boss told him to lie if asked, and he refused to and informed <end user>.

Cheap devices

I remember when, I think, Sony was hacked because of the movie « the interview ». It created enough of a news cycle shitstorm that our corporate overlords became excessively generous with our infosec budget and made it a tier 1 priority.

It went for measly .5% to a whooping 25% of IT expenditure.

On the other hand to really show they didn’t understand anything about it they recruited an experienced CISO and fired him a month later because an accountant’s workstation was hit by a ransomware. The guy barely had the time to start building a plan and launch a bunch of audit but still got the full blame for decades of neglects. (He eventually sued them and settled).

Whether you like it or not