Because the people who pay for everything don't "see" a problem. From the uneducated user's perspective, everything works "the same" whether or not it's encrypted. They don't see how anything is "broken" so why should they pay $$$ in the form of certs and staff time to upgrade (i.e., "fix") things?

(That's a possible explanation, not an excuse.)