I think social media companies don't need that

Enterprise software companies selling definitely need it. Customers ask was this tested? where is the test report?

It’s not even optional as soon as you’re getting close to any type of standards or compliance framework like SOC2 and the likes.