Oh it absolutely is, and the most humbling thing was realising that I would probably do exactly the same thing in their situation ;-)

However as a developer and business owner myself (as opposed to a security person), I genuinely thought more people would be more concerned about the security of their website. I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin....

You see not knowing is one thing, but knowing and being complacent is quite another. But we see that in more areas in life I guess :)