Also, this is what I would call a functioning market. People using SaaS products should make it very clear that skipping security will take "viable" out of you MVP. Making an example of them may be a humiliating experience for the guys who built this, but it incentivizes doing the right thing.