I don't think anyone should assume security practices at companies either are or aren't sufficient, without any knowledge one way or the other. Same thing with company size. Without actual knowledge, it doesn't make sense to assume it's too many, too few, or exactly the right amount.