being able to properly deal with scale and security. Being able to be confident that if I am capturing PII data into my application, its as secure as it can be and as secure as if a principal developer had put the architecture together etc.

Mass market SAAS will generally just use other products to handle this stuff. And if there does happen to be a leak, they just say sorry and move on, there are very few consequences for security failures.

What use is privacy and security when all our data lives in a DC in us-east-1?

You're right

but guess who advises that architecture and implements it... the principal developer/architect.

You can use good security tools, badly.