My point though, is that it's always a "secondary" or "tertiary" business concern... a point emboldened by the number and frequency of data breaches -- always followed of course, by the email newsletter follow-up & mea culpa. "We care about the security of your data, we swear. We regret to inform you that ..."
Sadly things are not always as they should be, friend...
Fixing smtp should be as important if not more than upgrading http 1.1.