Never mind industry best practices or the cautionary incidents at other companies -- this "it's not big until it bites us" attitude can be used to deprioritize fixing any risky behavior until it's too late.

There are low-stakes situations where this attitude is a virtue -- where the damage from an exploit is minor and quickly reversible. For famous and business-class internet services, the stakes are high.