Because it's not a problem.

- When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up?

- When was the last time a company lost a big contract because their company website login page didn't validate passwords properly?

- When was the last time a qualified regulator/auditor from a professional organisation had to approve and sign off a public facing computer system before it could be put into use?

You would think that "people will die" would be a good enough reason to make buildings with fireproof materials, alarms and good escape routes.[It wasn't](https://en.wikipedia.org/wiki/Beverly_Hills_Supper_Club_fire). We introduced regulation to force non-flammable building materials, fire safe designs with fire breaks, fire alarms.

You might think "people will die" would be a good enough reason to make *everyone* care about building structural design. [It isn't](https://en.wikipedia.org/wiki/Versailles_wedding_hall_disaster). [It just isn't](https://en.wikipedia.org/wiki/2013_Savar_building_collapse). We have to have regulation to have qualified engineers sign off on building designs, that they be designed and built for specific uses, and when things fail, society [takes the engineers to court](http://www.jpost.com/Israel/Court-upholds-prison-terms-in-Versailles-hall-disaster).

You would think that "people will die" would be a good enough reason to make food processing clean and safe, [but it wasn't](https://en.wikipedia.org/wiki/The_Jungle).

SQL Injection is less obvious, less publicly visible, and has less severity impact, and is in a completely unregulated industry. 

Even to companies which do care about it, they can't usefully advertise "*No known SQL injection vulnerabilities in our code*" as a marketing bullet point anyone cares about. It's not the sort of question customers ask salespeople.  It's not a competitive advantage for them, it's a cost, an overhead. Protecting against it makes them *less* competitive, slower moving, doing more work for the same functionality. 

**The incentives are all aligned for it to keep existing. So it keeps existing.**