The point is that the incentives are such that it's not necessarily rational for a young startup to ensure their product stays perfectly secure.

Startups are so precarious and need so much attention on other areas that for most types of startups, security holes are not the biggest existential threat.

And those incentives partially come from users who are more than happy to sign-up for a website someone threw together in a month without any thought about whether it's secure.