People who haven't worked in infosec think companies like that would naturally be good at security. In reality they're some of the worst. Breaches are just very rare.