I think the key phrase here is "low probability, high impact event". For a startup, ceasing to exist because nobody cares about your company is a high probability, high impact event. That's why many new products have gaping privacy problems. Also security flaws, technical debt, and other failures of sufficient planning and investment.

The challenge is that for a company with a good product, the highest risk threats (no product, crap product, nobody cares about product, etc) are mitigated. Then these lower-probability high-impact risks come to the front. This tends to happen faster than most small companies realize - like the first day there's any meaningful customer traction.

Suddenly, a team that's lived by 'move fast and break things' needs to catch their breath and pay down some debt - privacy, code quality, security, etc. Nobody enjoys that, so it's easy to postpone it too long.