Rather than in the top 10, you could say that it's ranked #3, although they do say that exploitation is difficult. There are some raw metrics on Git. OWASP TOP A8 actually refers to un-encrypted object streams, so the debate in "Which is better: “serialize and then encrypt” or “encrypt and then serialize”?" is not entirely on point.
Whilst there is a risk that answers might be opinionated, I'll try to use some concrete logic. And it really does come down to logic v semantics. A common paradigm in IT is:-
- make it work,
- make it right,
- make it fast[*].
Imagine the development of a remote function F that requires serialisation. It adds two streamed parameters and returns the sum. So
sum = F(a, b).
Now proceed with development using the above paradigm. Until point #1 is completed, the function does not work. No meeting, screaming or white boarding will help with that as it's a mathematical certainty.
As soon as F returns the correct values, it's working. Step #1 unequivocally complete. That's an easily (unit) tested logical argument. Steps #2 and #3 are therefore semantic arguments without the authority of pure logic. Who is to say what is "right" or "fast"? Throw in an Agile or DevOps mentality ("updated software can be deployed every few days, or even several times per day"[**]) and there is little reason to progress past step #1. Psychological conformism along the lines of Milgram and Zimbardo just means that people unconsciously "do what they are told" anyway. Like move onto the next job when #1 is achieved. Thus no encryption of the stream.
There are other reasons too numerous to mention.
[*] adapted from: ButlerLampson's "Hints for Computer System Design" (1983) http://research.microsoft.com/en-us/um/people/blampson/33-hints/webpage.html and Stephen C. Johnson and Brian W. Kernighan's "The C Language and Models for Systems Programming" in Byte magazine (August 1983).
[**] from https://devops.com/metrics-devops/