I've been through quite a few security audits, and had to steel-clad quite a few secure systems. Nothing is better than having a dedicated security team for those things. The bigger the better. There's a reason we teach junior developers not to write any "secure" code, even as simple as a login system, on their own.

I can understand why someone might "not see", but as someone who has seen security done wrong enough times by well-meaning small businesses, I trust the company with the bigger dedicated security team with the better-skilled experts.

What's left is the fact that "everyone will want to hack gmail, but nobody would try to hack TN or PM". Fair enough. But as that taught us growing up: "security through obscurity isn't".

I don't fault people who prefer using these smaller "privacy" companies. But please don't fault people who prefer to stick with the companies who stand tall through constant attacks.