Cyber security guy here.

Consider a large organization with a lot to lose. They usually invest proactively in a Cyber security program.

Now consider all these companies with data breaches. They were tiny startups with nothing to lose. No reason to consider an investment in cyber security best practices. Their modus operandi was quickly pushing the product to market so that the $ could start coming in.