You're misunderstanding the point. Pretend you're a cash-strapped startup, still financially in the red. You discover a security hole in your software. You have these choices on what to do today:
1) Spend the day implementing a new feature that will very likely improve revenue/traction
2) Spend the day doing preventative security measures to protect you from something that might only be a problem when you're actually making lots of money
You choose option #1. Choosing #2 is "harmful" to you and your investors.
1) Spend the day implementing a new feature that will very likely improve revenue/traction
2) Spend the day doing preventative security measures to protect you from something that might only be a problem when you're actually making lots of money
You choose option #1. Choosing #2 is "harmful" to you and your investors.