Some of this is psychology as well. We are biased towards preferring sure smaller gains over risky larger gains, and risky larger losses over sure smaller losses. Spending on preventive security is a sure small loss: the cost of more security. Reducing spending is a sure small gain.
