I work with companies < 50 people and do not hear this. Most of them are first looking for stability and velocity, then security.

Where I do see compliance come up is from customer demand or niche applications (healthcare). Even so, compliance is more about people and paper than technology, so yeah it takes longer, it's bureaucracy!