Anyone with a computer and a desire to break your stuff is milliseconds away from it, and they ARE the bad element. And that's exactly what it is. They arent preparded. Plain and simple. Not every sysadmin has time to read security mailing lists.
Companies are almost always less interested in security than in productivity.
As if all this weren't enough, most companies don't have enough sysadmins to meet their IT needs, even if they're already doing ZERO to fix their security problems. Because management doesn't see it as important until all the servers melt down. Because it's virtually impossible to show how it will advance the bottom line. I'm really sick of people blaming the admins.