I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. Okta being a good example, when it took a 10% drop after the breach last year.