Because it's not a high enough priority for them. As long as it's not significantly affecting their profits, they'll do the bare minimum moderation. Same idea goes for the weak cybersecurity companies seem to have. When it comes to their IP they'll spend the resources to protect it, but when it comes to their customers info leaking, they don't care.