An update on compliance for containers: but they are meant to be abandonware

I think pretty much both cases happen. I especially see inexperienced people get it wrong very often, mostly since they don't know any better or pick the path of least resistance, basically conditioned to mostly copy & paste from tutorials, stack overflow, blog articles etc. These are professionals in the sense that they're being paid for their work.

It's very easy to get a base setup for container infrastructure running, you can get all the script and automation to pull up infrastructure very quickly, however there is a very steep learning curve to actually understanding everything you have just deployed. Also, there is a very strong lack of policy and enforcement of policies because that's usually not an area that drives delivery of features. As long as the cost-benefit doesn't shift here many organizations and individuals will continue to wing it and think everything is alright because nothing ever actually happens or if something happens nobody is held accountable.