The reason they don't is that they just don't care... and for their business that's the rational decision. Data security isn't as core to their business as it is to a bank. If a bank has a breach, bank accounts get drained. If Equifax has a breach, it's annoying but manageable fines and their CEO gets grilled in a few congressional hearings.

Equifax's core business is about giving out credit scores. I'd bet their biggest fear is giving someone a high score when they deserve a low one. Data breaches, moderately inaccurate information... a nuisance, but a sideshow.