Do you even have any experience with how most companies work? SMEs barely have the cashflow to cover their daily expenses, let alone suddenly pay thousands for regular professional security audits and overhauls of their code. This is why security is an afterthought.
If builders can't build houses to code, and the buildings fall down, they shouldn't be allowed to stay in business.
If civil engineers build bridges that fail. Or doctors hurt patients. Or police officers shoot innocent people, they shouldn't keep their jobs.
Software engineers are no different. If you collect my user data and it's at high risk of leaking on the dark web, either clean up your act or close shop.
Security is always a cost center and rarely a profit center. That's the only thing that needs to be said.