Without naming names, there are specific well known fintechs who were not SOC or ISO compliant when they were 2 years old. Plenty of people did business with them because their customers were small businesses (mostly startups) who didn't think about such matters.