It's also harder to explain to your customers why you're the only product they use that has a security problem when an exploit does eventually happen.

You see this already with uptime. If Github or AWS has a major outage, it's in the news and even people that don't understand software realize it's just "something happening today, everything is down".

And, unfortunately, in practice customers don't care about this inverse, when "everyone else is down but not that one product".

Good like trying to explain to your customers that their data is no more accessible because some api key ended up in a public git repo or since you admin panel is exposed to whole internet someone was able to log in.

Especially when the customers' own websites or services are down, they are a lot more understanding.