Just throwing this out there - any highly regulated and/or political entity has the bottom-dollar solution for tech/IT. Got out of the education software sector because of it myself.

The problem is that it takes real budgets and effort to build these highly complex systems. It requires teams of competent engineers that are willing to take the extra steps to ensure the systems they're building/connecting are managed in a security-positive manner. When these sort of projects are bid out it's usually the bottom-dollar bidder and/or whoever has the most "good ol' boy" connections; this often doesn't correlate to the previously stated need for technical competency.

Also there's the problem of talent. Private vs. public sector development firms typically pay out on different scales for similar work/stress loads.

All of this is anecdotal but I'm so not surprised.