Secondly, this was years ago when only a few people (and companies for that matter) were as information security aware as they are now.
Many if not most will choose convenience over adequate security, e.g., they will retain a PIN such as 0000 if the system allows it.