Japan has a very shit reputation for security. No one wants to take the time or money to do it properly and every year shit gets hacked. I've been impacted by several breaches here. And yet shit doesn't change.
As a small business owner (I sell extra veg I grow), I had to sign my life away about authentication practices, data storage, 2fa, etc. just to sell a few orders a year. Giant companies can just fuck off on security and not face meaningful consequences.