Ehh... SQL injections are not on the same order of seriousness as storing passwords in plaintext, IMHO.
The average web service has a complexity far greater than any college course project. SQL injections can be mitigated using the correct tools and methodology, but things like this (and buffer overflows) will continue to exist. Such is the nature of things.
There's "oh man, this one variable isn't sanitized", which is a bad, but understandable mistake.
Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds.
No seriously, the last time I made that mistake was when I was 15.
And some of those companies get caught out and lose a lot of money for it. I'd rather retake the failed class. The real world is harsher than academia.
But if the company spent its time solving every theoretical security problem, it would have never had a product to make money with in the first place. It is a balance, and "zero tolerance" is silly.
(So is not using a modern database abstraction library. Even PHP has them these days!)
Normally I'm not so hasty to call for head-chopping and head-rolling family fun, but I would think this is entirely called for.