Are they not allowed to shift priorities as they grow? I'm sure there are many things you genuinely care for these days which wouldn't have been true a few years ago. It would be dismissive for me to assert you don't truly care about those things, would it not?
That's not fair. A lot of companies start off not caring about security because they just need to ship and grow. They add security later after they get owned or when they need to take on the type of customer that also genuinely care about security. Maybe they didn't care before and they care now. That's allowed.
I disagree. At this point, there's no real reason to just not care about security from day one.
There's a wealth of tools and docs, and users are becoming more and more conscious (which is fantastic, for the record!). There's the obvious ethics of keeping the data your users entrust you with safe to the best of your abilities, too.
There's a real reason to not care about security from day one... the competitor who doesn't care will beat you to market, and then you don't get a day 2.
Sorry, but the vast majority of people just don't care. Customers want a working product.
