It's rare that groups go back on their word, and those that do don't last long. The reputation for these groups is everything, and all well known groups keeps their promises.
And it's part of doing business for them, that's what capitalism requires. If you want change, governments needs to enforce security standards, since no company will do that on their own. Look at Microsoft, who exposed US government data due to their shitty security practices, government still keeping their contacts with them.