This only holds for companies that do not have to comply with some regulation or standard, e.g. ISO 27001, to do business. Especially infrastructure, banking, and defense tech have high compliance requirements that also, and sometimes esp. cover software development.