Its not all that ridiculous. A company that I used to work for did this. And while anecdote != data, I've seen it happen often enough to realize that a lot of devs just dont care about security.