While I don't know enough to refute the main fact, my gut feeling is that while that may be true, any company doing this time of work on the web needs to at least take care of the base amount of security (using HTTPS where applicable, not storing plain text passwords, etc.)