Businesses and people in general cheap out on things that they don't see themselves having immediate use for. Investing in cyber security is like having good insurance. You might never need it in 50 years of business, but if you did, you'd be glad you have it.
I do see the attitude changing slowly, with more investment into the space, but we need to do more, especially for critical infrastructure