The people making the decision judge their personal risk to be higher if they initiate the change than if they stick with the status quo, even with the chance that it causes a major breach—they might not get blamed for that, anyway. Same as most business decisions.