This is one part conjecture, one part speculation and two parts observation, but I think this is due to the stigma already existing around ROSI. A lot of senior managers relate return on security investment to quantifying the return for a fire extinguisher. Another reason is that initial values can be arbitrary estimates, not hard numbers subject to future manipulation. Its important to be accurate, but you dont have to be precise, but not precise. Next read this article on the IDG blog here: http://www.idgcomm.com/ROSI.”]
Source: https://www.csoonline.com/article/2117948/rosi-distrust.html