(I do think many people at these companies want to mitigate risks, but they are in a competitive situation where there is a relatively low ceiling on how much effort can be put into each risk area / how much a launch can be delayed etc. compared to what they'd ideally want)

OMG I forgot a pun!!! My line is not "what gets litigated gets managed," it's "what gets litigated gets mitigated" (which in turn is a reference to "what gets measured gets managed")