I think a company cannot run only on teams delivering features. There will always be some functions like HR, legal or sales. I think security fits in there nice

I think a company cannot run only on teams delivering features. There will always be some functions like HR, legal or sales. I think security fits in there nicely, it is quite similiar to compliance. A security team is not delivering security by itself, it is more like an HR department trying to prevent workplace harassment or a legal team trying to prevent GDPR violations. You might also think of it not as a team at all, when you are consulting for other teams, you are delivering features as part of that team.