What’s the cost of a security issue?

I am dealing with a weird situation: I have reported a couple of security issues in our product, but managed is like “meh, who cares.”

There even is a video demonstrating how to log into our device without a password. They shrug it off, the issues were archived and the latest update still has the same issues.

I am now trying to show them that it’s a lot cheaper to just fix it before anyone discovers this in the field – and wonder: are there any hard numbers I can use? Real life examples with a price tag attached?