One area where I would say that full-time matters more is if your product's target is big enterprise customers. Those are a bit harder to sell bootstrapping/moonlighting.
Although SOC2 is fairly easy to get, it's expensive for bootstrapped founders (maybe $30-45k all in.)
It wasn't enterprise, but the 600 person company (that I knew very well) simply wouldn't work with us in the end because we were too small (2 of us.) It sucked, a lot, because the deal cycle took about 18 months to get to a firm no. Since then, everyone involved has left the company
Don't invest a lot of time in individual deals when you're small. Aside from the time and probably attorney fees (and opportunity cost), it's pretty demoralizing if it doesn't come through, and most of the time it doesn't, especially when you're small. The distraction alone can kill your company.
Focus on many smaller deals rather than one or two big deals.
Btw the price comes from my latest adventure. I think 12k is too low unless you can literally do everything without help (i could have but it would've destroyed my time.) 20k is probably a realistic price floor with pentest included.
Although type 1 doesn't require a pen test or you to actually do anything. Just to say you would do it a certain way. Every prospect that has asked for SOC2 has wanted a separate pentest deliverable.