My buddy owns a cybersecurity company and another guy I know works with mining absolutely huge datasets.

They continue to remind me that the internet is built to connect, not to secure, and that even very basic security measures are almost never in place because they are just simply overlooked.

I used to think data breaches were because of basic password leaks, lookups, and brute forcing (loan out your key, under the doormat, or use a credit card to jimmy the lock).  But now I know that 80% of cybersecurity is about just inviting people into your data storehouse and never kicking them out.  Exactly as you described in your original post.