Compliance is not security, but "security" is too nebulous of a term to actually implement effectively, so companies use the specific regulations and standards to have a measurable target to strive for.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.