And "a very limited number" may mean "though we pretend to be a big company, we have a limited number of customers and while they all pay licence fees, most are not actually using the product in production."
You pay them a million per year, and fire them when a breach happens.
Way cheaper than improving security.