IMHO it's a matter of chance/game theory. Taking a proactive approach is expensive (security will slow down your development and operation) and most likely won't benefit you much.