Companies do try in earnest. I'd be willing to admit that bigger companies probably try a lot harder. Firms like Ebay are constantly training (and retraining) their employees on social engineering, document security, the risks of transferable media (e.g. USB drives), etc.
However, it is practically impossible for a company to put bulletproof safeguards around things like:
+ Laziness (opting for convenience vs. security)
+ Ignorance
+ Malice (intentional compromise of information)
+ Plain old human error
So the question really becomes, when has a company done enough...?
It's not so hard to lift yourself by your bootstraps once you're off the ground. -- Daniel B. Luten