No, that's not a brag but a suggestion to take things into context and not apply soc2 as a cookie cutter solution where a 20k employee enterprise and a 20 people startup must share commonalities.

In a 20 people startup it's very likely that most engineers have access to production anyway and can inject malicious stuff directly, so PRs stop no one really.