One alternative is you get the standards and quite a few components (eg FOSS) that help meet them. You aren't evaluated unless you're sued due to harms from your product. The potential fines or damages go up with the amount of negligence they find. This way, it only costs money when harm happens.

Meanwhile, people wanting to use higher security as a differentiator can get evaluated ahead of time as some do now.