There is little to no penalty if your software is crap from a security or privacy point of view and you are popular enough.
The example I used is Whatsapp. On the early days, but definitely after their popularity was already high in Europe, you could still impersonate any user on the platform trivially. Their only real security was obfuscation of the client source code, obfuscation of the protocol. Doesn't help much when you still have a Java (J2ME) client that is trivial to decompile. They still became hugely popular.
People quickly forget about this type of issues, or they don't assign blame where it belongs. They will just shrug over it and start believing that it is normal for computers to get hacked from time to time. After all, it appears all the time on TV.
Yes, but people are short sighted. They also probably think “I’d rather grow quickly and be able to afford this down the line than do it right and risk missing out.”
Which comes from being inexperienced as well. And an experienced hand can save you money immediately. Such as selecting a more appropriate programming language to implement the project in. Suggesting an appropriate library to use rather than rolling one's own. Avoiding multithreaded coding disasters. Having a backup system that works. Having a revision control system that works. Knowing that unit tests have an immediate payoff. Avoiding stupid metrics like paying people based on lines of code written. Avoiding rolling your own encryption. Don't transmit passwords in plaintext. Don't do illegal things. Don't leave yourself wide open to lawsuits. Use a real CPA to do your taxes. Keep proper business records so the IRS doesn't hang you. And on and on.
My CPA makes lots of money when some young entrepreneur comes in all terrified that the IRS is auditing him and he kept no records and didn't even file returns.
An experienced hand will tell you to never ignore and never mess with the tax man.
Check out what happened to Will Smith when he paid no attention to the IRS. All his proceeds from "Fresh Prince of Bel Air" went to the IRS as taxes, interest, and penalties.
Is this maybe a side effect of leadership in these startups being more junior themselves and not realizing the value they're missing out on by not pulling in some of that experience?
