I would claim the opposite. If you're starting a business you'll research how to click your backend together in a way that doesn't leak all of your user's data in all directions. Than you'll build a backend that never had these problems to begin with.

It's much more of a pain for companies that already have a tried and true stack but didn't use the two full years of warning to replace the parts of the backend that isn't compliant. No rest for the wicked.