Good security and good security people cost money but don't generate any visible revenue. So if you care about your balance sheet, they make you look bad.

Optimism bias is also a thing. People assume bad things won't happen to them. (This is a psychological phenomenon not just an IT thing). So if you're an exec, you could advocate for spending the money or you could just pocket your bonus for cutting costs and go "pfft nothing is going to happen".

And there's the old "if it's cheaper to deal with breaches if they happen than to pay security staff most places are just going to assume nothing bad will happen and deal with the cost if it ever comes up".