Lack of knowledge.

Lack of experience.

Lack of direction.

Lack of time.

Lack of imperative.

There is often nothing driving the security needs. No stakeholder caring usually means no one will commit to it.