If you're in the bootstrap phase and don't have a lot of employees, then yes, I agree with you. But as soon as you can afford it and/or as soon as you get big

If you're in the bootstrap phase and don't have a lot of employees, then yes, I agree with you. But as soon as you can afford it and/or as soon as you get big enough, you should have at least one FTE who focuses purely on security. This applies to any company with an Internet presence.