Having worked in a large set of codebases as a consultant, I'm pretty sure it's the former. The code that runs the world is mostly garbage (the proprietary stuff that is, because they can hide it)
Similarly, never count on a compromise of your data to get reported unless local law absolutely requires it, and someone who cares notices. If your data was compromised in a way not covered by local law, companies will hide the compromise.
