Here's a true story about one instantiation of "security is our top priority". You be the judge on whether this is an extreme outlier or pretty much the norm.
I was at one company where the PM blurted out (paraphrasing, but very close) "Enough of security talk. We will put out some nice wording on our website stating that security is our top priority and our product is perfectly secure. And that's that. We will not spend a single penny beyond that on making it so-called secure."
So, that's often what companies mean when they say "security is our top priority".
(The referred PM has since had a long career at a fruit-shaped FAANG, presumably making products secure. I hope they have grown up a bit.)
I was at one company where the PM blurted out (paraphrasing, but very close) "Enough of security talk. We will put out some nice wording on our website stating that security is our top priority and our product is perfectly secure. And that's that. We will not spend a single penny beyond that on making it so-called secure."
So, that's often what companies mean when they say "security is our top priority".
(The referred PM has since had a long career at a fruit-shaped FAANG, presumably making products secure. I hope they have grown up a bit.)