There are a whole host of compliance and security issues that you don’t have to (and shouldn’t) worry about when you’re small. Employee background checks, documented disaster recovery plan, 3rd party pen testing, etc. Those are things you worry about once you have built something. It’s different than just application security which itself can always be improved over time even if it wasn’t an afterthought.