Difficult often implies additional resourcing and development related costs.

Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values.

Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.