It’s been well known for decades that most government orgs

I've seen Muni and Regional gov and also dotcoms.

The Govs I've been at were crazy-tight about security. They were unionized and could decide based on conscience vs costs. Dotcoms, though, followed a different trending, one that really focused on costs.