Corporation are not able to "care". It's the boxes's fault. That is, legislation and/or enforcement.
This meme again? Corporations are not capable of anything, but corporations are made of people, and people can care.
Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.
By that logic governments are not able to "care" either.
But both are examples of cybernetic entities, if they don't care then their control loops aren't correctly aligned.