I don't think it's necessarily that clear cut - the big problem is the lack of knowledge that encryption isn't good enough. There are probably plenty of developers who do care, and aren't aware that the clever algorithm they're using with the key hard-coded in the source code may not be 'secure.' And of the set who know that hashing !== encryption, probably a lot of them (at least in PHP land) will be told to just use md5.