The reason I mentioned US specifically was because VC funding to support hyper growth was historically & (still is) way more common there than elsewhere in the world(Western Europe specifically). A condition which seems to almost mandate the grow fast at all costs mentality.

It doesn't preclude anywhere else in the world from being lax about security. I also have worked for multiple small/mid companies in Western Europe and, anecdotally for me, data & thoughts to security are held in much higher regard.