To say that trillion dollar companies are less likely to fail at security/privacy because all their decisions take into consideration the hypothesis of reputation damage seems simplistic. They also have the money to pay for damage control.