There's no cap on how much someone could spend on security, and even if you spend all of the possible money, there still could be security issues. That's not something you can fix purely with money. It's a continuous effort and they just need to accept certain risks if they want to have smooth user experience.

Now don't know how much stake is spending for security, and how they have build it. But why would anyone assume they wouldn't want to spend as much as possible? All of the money and reputations is at stake (pun intented). Obviously they can't and shouldn't tell all of their counter measures against hacks, because it would be unwise to tell about any potential blind spots. But i wouldn't assume it's not enough. Even if there are hacks happening (which are happening in everywhere).

And you have to spend money to make money. Budget for secure and profitable site is a balance which i am certain they have experts dealing with. More advertising brings more revenue. That's why even most famous brands still keep doing it. And you need that money to pay for that security for example. Now i totally sound like a fanboy, but i feel weird why people would suggest that they don't know what they are doing. They are a casino that wants to stay open. Security is obviously a big part of that to happen.