The ignorance of a company like PayPal is obviously bad.

That said, I think we need to have an equivalent of automated integration testing for security vulnerabilities.

Even if PenTesters (or whatever they're called these days) do some testing and uncover some bugs, the applications under continuous development will inevitably introduce "bugs" not seen before.