No one suggests that startups not over-optimize on security or performance because these are not their core business. They suggest that they don't optimize for

No one suggests that startups not over-optimize on security or performance because these are not their core business. They suggest that they don't optimize for them because they have extremely limited resources compared to big corporations like Sony. It doesn't matter how much time a startup spends on security and performance if they never find product-market fit and get to the explosive growth phase. Once they do however, this is when they need to raise real money and start addressing these "non-core" issues as well. Sony is not a startup, is not resource constrained, etc. There's absolutely no reason to empathize with them.