On some level, the fact that compliance regulations exist is an indication that security is not a priority for many of the entities that it applies to.

Certainly snake-oil is a problem, but I think this particular area is one where buyers are most concerned about being able to effectively claim that they made what seemed like reasonable efforts.