> The limit is that barely anyone wants to pay the bill

Do you even have any experience with how most companies work? SMEs barely have the cashflow to cover their daily expenses, let alone suddenly pay thousands for regular professional security audits and overhauls of their code. This is why security is an afterthought.

If restaurants can't make sure their food is safe to eat, they shouldn't be allowed to be in business.

If builders can't build houses to code, and the buildings fall down, they shouldn't be allowed to stay in business.

If civil engineers build bridges that fail. Or doctors hurt patients. Or police officers shoot innocent people, they shouldn't keep their jobs.

Software engineers are no different. If you collect my user data and it's at high risk of leaking on the dark web, either clean up your act or close shop.

> This is why security is an afterthought.

Security is always a cost center and rarely a profit center. That's the only thing that needs to be said.