I'm thinking it if more of a regulations issue. There is more involved in the requirements for checking boxes on forms than actually making systems secure.

SANS has been commenting on this in their newletters. Check them out at http://www.sans.org/newsletters/