It's a matter of exposure and attack surface vs rewards for the attacker, and risk in companies are evaluated by the trio: freqency of occurrence, severity of occurrence (how large), severity of the occurrence. Banks can spend a lot because severity quickly gets very high in money.

What's the incentive again for the next gov to properly fund the system? Oh yes: they would have to say "sorry! shit happens! that's all because of the previous admin!!" and maybe throw one guy under the bus.