I agree with rubben, could be cost issue and they'd rather not deal with it until its too late, thats why #DFIR is becoming so popular (Hey I got hacked, come and fix everything as it didn't happen)
Although it's understandable to not spend money on top of what has already been, I guess it's better to do spend some rather than be left out of business, some of those organisations' web servers are quite popular and are visited tens of thousands of times daily. That really exposes a lot of customers and the company as well, i mean even a simple XXS can be catastrophic, such as redirect user to a similiar looking page with a big red text saying please download our new protect's update it has awesome features .. well you could imagine what those features are :D