There are many examples of experienced teams doing stupid things like exposing databases that I don't really think this is a valid conclusion to draw.
https://news.ycombinator.com/item?id=41678840
The joke is these companies build systems that can tell them how to implement better security, they simply don't care.