While there are incentive problems across all levels, The political quagmires that make it impossible to move at any reasonable speed, and that lead to counterproductive ideas getting large budgets are in my experience very common at the highest sizes. It's true that on the other edge of the spectrum, small startups make poor choices, but many of said startups will fail due to said choices. So by the time you have a viable company making good money, the really badly aligned companies are gone.

So when I look throughout my long employment career for best security and organizational practices, all the highlights are still relatively, relatively undersized companies, with headcounts in the 3-4 figures. It's as they grow, and start to be multi-headed behemoths, that they decay again, as what is good for the responsable mid-level exec, for the business unit, and for the company as a whole start to have nothing to do with each other. That's when you can smell the decay in the hallways. A few large companies manage to stave off this rot a little more than others, but it's inevitable. Then nothing important can be done in a timely fashion.

> but many of said startups will fail due to said choices. So by the time you have a viable company making good money, the really badly aligned companies are gone.

I wish that was the case, but that isn't how startups fail generally, sure very bad user facing breaches could cause something like that, but lots of platforms with too much jank have somehow survived all of these cyber vulnerabilities before, and will probably keep at it.

For a majority startups it's about connections and relationships rather than competence. Very few even consider building actually useful products to be a priority after the initial work of building it.