To what extent does user trust factor into how lean a startup can be?

A small company can't afford to spend a lot of resources on data integrity and protection, encryption and retention best practices, keeping up with laws like the GDPR, and they're that much closer to going bankrupt and having the data they've collected become part of asset liquidation and auction. It seems like these days, the discerning consumer ought to put more trust in a larger company's offerings in a given space than a smaller company, and even be wary of a smaller company that's offering something truly novel if that novelty isn't worth the price of private data being at-risk.