I don’t see how any of this was the executives fault. They have no idea of computer security and hired people who they thought were competent to handle it.
Execs hired incompetent (or maybe just "profit oriented") management and that incompetence trickled down to the bottom.