The book company could then buy a standard product as a simple cost, while the security company attaches direct revenue to effective security.
I guess the IT/security company would need to run your infrastructure to be able to set up monitoring and such?
That can still be hard to accurately measure. You can measure, of course, how much revenue was attributed to sales of the product developed by the team, but how much of that is attributable to the team's work and how much is attributable to company-wide marketing and how much is due to company image developed by public experience with products developed by other teams is...not always readily obvious. (And, of course, then you have teams that aren't devoted to particular products or which provide company-wide services supporting product teams, but not directly generating revenue -- unless, of course, you organize your company so that accounting, HR, marketing, etc., are all broken up and product-team specific.)
Of course, if you measure by the entire company a lot of that uncertainty gets washed out.
I'm guessing that's true for a lot of areas in a large company. What about the department that takes care of buildings or HR for example?