My assumption has always been that companies large enough to have a security team also have better security practices than my small company. E.g. I'd guess Atlassian infrastructure folks don't share ssh keys over chat. Maybe they do.
Security is just as much (if not more) responding to a breach effectively and quickly as it is preventing one.