(1) SOC2 is somewhere between $10,000 and $20,000 if you do it cheap.

(2) That's a dollar amount that most bootstrappers can swing.

(3) Critically, you don't do SOC2 until you have a critical mass of purchases requiring it.

(4) Many (most?) of your customers, especially your early customers, won't require it, and/or will have alternate paths for companies without a SOC2 attestation.

(5) When you finally do hit the big deal that absolutely demands an attestation, you can often cut a contingent PO: you sign the deal, deliver the stuff, but you don't get paid (or you don't get the last tranche) until you get the SOC2 attestation.

(6) You can get a SOC2 attestation real, real quick.

There may be other things keeping people from bootstrapping SAAS businesses, but this isn't one of them.