I think you've hit the nail on the head. When the company is small (like a traditional startup), the main risk is not delivering features. When the company is l

I think you've hit the nail on the head. When the company is small (like a traditional startup), the main risk is not delivering features. When the company is large, the main risk is loss of {data, privacy, uptime, reputation, lawsuits, unexpected licensing fees}. So large companies put in place systems to reduce those risks. Unfortunately the default seems to be to make it hard to deliver features.