I disagree but sadly this is true.
This is the common misconception about security. Companies and individuals often neglect the idea of security as main necessity for requirements, design, implementation and initial philosophy of an organization or a person. Information acquired by a person or a company must be safeguarded from the time the information has been acquired. And how it should be stored, used and disposed (if necessary) is also a part of the security measures by the company or a person.
