I disagree that you are golden if you only have one scandal every few years. You can have zero scandals and still be screwed. If a company has its valuable IP stolen and is then undercut by competitors that never had to spend on R&D it can be a significant loss of revenue.

I also disagree that the risk of an attack is low. An F500 company is the sort of target that can end up in the sights of many different threat actors.