And some of those companies get caught out and lose a lot of money for it. I'd rather retake the failed class. The real world is harsher than academia.
But if the company spent its time solving every theoretical security problem, it would have never had a product to make money with in the first place. It is a balance, and "zero tolerance" is silly.
(So is not using a modern database abstraction library. Even PHP has them these days!)
