It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.