If I was the CTO or CIO then to CYA I would pay some security consultant $700/hr for a 2hr briefing on the best practices for handling user data. A beginner should know that experts are knowledgeable, and a bunch of FAANG and VCs should have known that. Then when the consultant mentions having rate limits for media to protect against scraping, you would look into seeing if you're already doing that. It's not rocket science it's just a webapp