The main reason for this kind of thing is simple: the people setting the priorities and development schedules at most web sites don't even know what security is.
guess what ? i've been asked to remove all those "useless security checking stuff" because it was slowing the site down !! i couldn't believe it, but i had to remove everything !! talk about incompetent managers ....