I guess so… there seems to be absolutely no consequences to getting hacked, so from a business perspective it makes a lot of sense.
It's not up to me to decide what policy to use, and if it was I couldn't just do whatever I wanted, I'd have to justify its cost. And every company does the same…
I can decide the policy at my home :)