This is absolutely true. But shitty technology tends to have hard upper limits to scalability and shitty security tends to put hard upper limits on the company life span. It's interesting how established companies can have one security issue after another but the customers are so locked in they can't leave and so those companies are not nearly as affected as they should be (Equifax anybody?). But your run-of-the-mill start-up would be mortally wounded by such an affair because they still need to sign the bulk of their customers.

Of course it doesn't always play out like that (to every rule there are plenty of exceptions), but investors don't like to be associated with companies that fail or that blow up their reputations either because it makes their exit that much harder or even impossible.

I've seen investors that took the responsible route and made fixing major security issues or other undesirable elements of the target companies a condition to investment and typically these investments succeed in the longer term, not in the least because they cleaned up their act and could then turn that into a USP relative to the rest of the field.

Even so: better invest in a company with a mediocre product and a stellar sales team than to invest in a company with a fantastic product and a mediocre sales team. The first one will get you a better ROI, and tech can be fixed post deal.