What big companies are you referring to? Protecting data takes effort, so by virtue of that, intent is a necessary precondition.

Most companies probably don't take care of these things at the rate or level you seem to be assuming that they do.