Nicely said. One point to add would be that bolting on security/privacy after the fact generally results in failure. The "highest risk threats" you mention push companies toward trying to solve their technical debt later, if they survive, but this just makes the after-thought bolt-on failures more probable.