I've normally heard it that they pay current insiders rather than try to get outsiders to join. Though I'd appreciate links to well documented cases to the contrary.

Also, really, none of this matters for 99.99% of the companies out there. The weak point is far from hiring practices. The weak point is almost always cybersec or social engineering.