Yeah this would be bad for innovation as well. All things equal, the startups that emphasize security to the detriment of functionality will lose to those that get the product to market faster and secure it later.

Not saying this is ideal (I’d love security to be a competitive advantage and properly required so startups start prioritizing it), but I’d say we need to focus security on the platforms and tech used by most startups so that their attack surface is their unique product.