Keeping in mind governments can screw up this badly.. the security errors some startup's launch with don't seem so bad.
It is true that startups should not concentrate on perfect security, as supplying something the buyers want should be absolute priority number one, but even then there's no reason to not at least get the basics right if there is any kind of sensitive data involved.