In my experience it is not surprising at all. Without a vocal and engaging security advocate and a shared belief in the sensitive nature of the company's data and processes - all devices in the employee's possession are insecure.

If you think with a security mindset you probably work in security.