Re: "Travelex had public-facing Windows remote-desktop servers with no NLA enabled"
You nailed it. IT failures are considered a cost of doing business. There's even insurance available to cover the cost. Do it right has been replaced by do it cheap. Management is rewarded, not sacked, for cutting costs, regardless of the consequences.