I think it depends on how much attention the smaller organization gets. I can totally see a CDO being a de-facto requirement for Bay Area startups due to all the pressure from the politics in the area.

It's also possible a small to mid size organization gets into some imbroglio on Twitter and realizes they need a CDO to try and stop the bad PR.