Or they have been telling management for years that security needs to be improved and more spending is needed to do that but management declined to provide funding.
It's still on the onus of the employee to properly state their viewpoint and deliver a proper business document, outlining the risks and benefits. Too many times I've seen security been increased and upgraded, at the cost of the entire business shutting down, or even worse, layoffs.