This will be the same in a great many places, including western companies. It is market forces in action, the race to the bottom, and a consequence of going for the option that "looks the part and it cheap" for too long which makes the supply-side players support being fast to market with the right buzzword features cheaper than the other lot and the bare minimum of care for other considerations.

The people making the buying decisions are at least vaguely aware of the problem, but work under the hope that they'll be long gone (or the kit will have been replaced by something else) before any excrement gets uncomfortably close to the air conditioning system.

At some point things come to a head and people look more deeply into the problem, hence:

> HCSEC threw a wobbly and told Huawei to sort itself out pronto

What has brought things to a head this time is the question "are we sure that can we trust Chinese companies?" combined with the question come out of the various public surveillance/recording news stories "can we trust any companies?!". People are being told to dig by the powers that be because said powers don't want to be the ones to make a cock-up while there is some public scrutiny going on.

> the Chinese company still came back with software containing "code that is vulnerable to 10 publicly disclosed OpenSSL vulnerabilities some dating back to 2006

That though is particularly damning. Having been pointed to the problem and told to sort it out, they seem to have done less than the bare minimum and hoped to get away with it. Just think how lazy they were being when not actively being told to be more careful, and how lazy they might go back to being if this all blows over before significant internal change is made.