From my experience, larger, established businesses care very much about risk mitigation. Legal is a huge component of large businesses. Fixing and maintaining

From my experience, larger, established businesses care very much about risk mitigation. Legal is a huge component of large businesses. Fixing and maintaining software can not only cause bugs but may open a business open to serious legal problems. So maybe a small change goes into production, and there's no problems reported; everything is fine. Well you find out later down the road that Cambridge Analytic was siphoning off data from a properly working API deployed months before. No engineers were at fault. No problems reported in production. But also there was no legal analysis of the feature nor of the deployment in production. Again, it's about risk. The more users or money flowing through the system the higher likelihood you're opening up the business to potential legal risks. Big or small changes to a system used by big businesses must be carefully analyzed for potential serious negative financial impact on the business; from a legal, business, marketing perspective. It's much simpler for a startup with a fraction of the users; because, again, they are exposed to less risk. Either way, it's a great question.