There is no incentive for startups to focus on good security. There is also no meaningful punishment for failing to secure your product (see Equifax). No carrot

There is no incentive for startups to focus on good security. There is also no meaningful punishment for failing to secure your product (see Equifax). No carrot and no stick = recipe for disaster.