the average corporation does not care about security as long as someone else is paying the price. moreover they actively drag on security best-practices if they increase costs or introduce any friction whatsoever into consumer purchases. one of the reasons why we don't have CHIP+PIN in the US

There are a lot of things the average person simply does not care about as regards standardisation, or codes, or laws, or procedures, which government (or other entities) manage to find solutions for.

I would actually put that concern near the top of my list of things that is not relevant to this discussion.