Profit/cost center is kind of a false dichotomy in some places. At the least, it lacks nuance. If you sell software or services that require privileged access, security tends to be valued more highly than a checkbox.