This is exactly the problem. Plenty of folks who’ve worked at small startups that haven’t faced regulatory scrutiny can tell you about how poor the common data

This is exactly the problem. Plenty of folks who’ve worked at small startups that haven’t faced regulatory scrutiny can tell you about how poor the common data handling practices are relative to the major leagues. e.g. unilateral write access (no multiparty approvals), no TTLs or deletion guarantees, overly broad access, stale / unmaintained ACLs, copies of production data all over the place, supply chain vulnerabilities, lack of mTLS / endpoint security, etc. etc. The upside (for end users) of big brand names being big targets is they have a lot more to lose than your average startup that no one will remember when it folds and sells its data.