they should, especially as a smaller business, as data leaks could run into GDPR problems. my ex-employer, for example, handled all customer data in plaintext and never delete data for people who were no longer customers. he also insisted on using non-secured channels for business related information/secrets. and zero backup systems. malware ripe for the taking lol. had one system crash and he went mental but refused to accept a backup solution. absolutely no understanding of IT and deaf to any recommendations because of fear that he'd be unable to replace me with a cheaper employee once i was done setting everything up.

three years later, three employees later, and the cheaper replacements were unable to do anything anyway and it's all broken now. but i'm sure in his mind it's all my fault.

so yes, they don't, either due to incompetence or to cut corners. but they definitely should.