Most C-level people couldn't care less about security. I'm yet to work for a SaaS that implements 2FA, yet at some point all of them have had passwords that a script kiddie could brute force within an hour. The only time I've seen security become a top-level priority was when some customer demanded some kind of checkbox compliance like SOC / ISO27001.