Are model security risks (extraction, poisoning) actually being tested in production? [R]

Talk to a lot of ML teams who ship models but skip any adversarial testing before deployment. Feels like security review for models is way behind where it is for regular software. Anyone here actually doing this at their job?