Dropbox taught me a lesson: you can be careless about security, directly and blatantly lie about security to users then handwave when caught and still be massively successful.
I haven't kept up on things but when has Dropbox lied about security/had exploits/etc? Not saying they are perfect but other than some random people on twitter claiming they exploited them have there been other issues?
Dropbox stated that they could not access your data ("employees aren't able"), which was simply and obviously just false. They mumbled and backpedaled and said "ok well employees can access you're data, they're just not allowed to". Instead of an immediate retraction saying their previous statements were invalid and obviously a mistake, they tried to justify it and blame users for being confused.
Dropbox also had a deploy that disabled password checking. As in, anyone could log into any account because passwords weren't checked. I suppose that's understandable - people make mistakes and sometimes you deploy things you shouldn't.
