For some single-person or even small group project, I can understand not having time to deal with something. At the point that it is a large, commercial entity and running a lot of the world’s devices, there should be legal implications for such negligence.