Not just that, but they have an incentive to be bad at security, so they can brag about and promote what the model achieved.