My interpretation of your statement is that organizations in the US don't care about security and do the bare minimum to secure their systems, if anything at all

Sounds accurate, sadly