There's a big problem of information asymmetry, though. "Security" is a very noisy metric, and not a quality that's easily evaluated by 99.9% of your customers.

There's a big problem of information asymmetry, though. "Security" is a very noisy metric, and not a quality that's easily evaluated by 99.9% of your customers. Outside of specialty domains like national defense (and even then...) customers don't generally care about "secure", they care about "not obviously insecure", and almost all products will appear to be "secure" enough right up until the moment that they're visibly or publicly compromised. If you either stay under the radar or get lucky long enough, you can turn profits for quite a while before the chickens come home to roost.