Comment by toomuchtodo

If there is no or limited financial loss or penalty when something goes wrong, there is no incentive for startups to prioritize or pay for security. Go where the comp is.