> so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working"
They have a lot less information. Consider my too examples. What do they record electronically? Name and address. The church will have relationship to people such as spouse and children, which are in public records anyway. A few details of sons preferences and involvements. The theatre is even more public - if you act its publicised. They might both have records of tax deductible donations. They do not have unique identifiers such as appear on ID documents or NI (UK tax and social security) numbers. They do not correlate this with outside sources. There is very little to leak.
They have a lot less information. Consider my too examples. What do they record electronically? Name and address. The church will have relationship to people such as spouse and children, which are in public records anyway. A few details of sons preferences and involvements. The theatre is even more public - if you act its publicised. They might both have records of tax deductible donations. They do not have unique identifiers such as appear on ID documents or NI (UK tax and social security) numbers. They do not correlate this with outside sources. There is very little to leak.