1) Has been told what needs to be done and decided to nix the idea because security is a cost center that cuts into their bonus potential.
Edit: whoops Equifax, not Experian
Equifax stock has gone up since the 2017 data breach, though because consumers are not customers of Equifax, it's banks and lenders who are not concerned with data they don't control. If hackers had broke into Equifax and changed people's credit scores, the banks might have been a bit more concerned.
The equivalent of a regular person having to give up the coins they found in their couch cushions.
If taking on that risk gives someone a 90% chance at a massive comp boost and a 10% chance at a more negative outcome where they're likely still well compensated, many execs would consider that.