Absolutely, but it's not just nonprofits. It's become a competitive barrier to entry exercise throughout industry. Only the big, established players can afford to do this, and it functions as a sort of tax.
As you stated, this functions to benefit the large organizations that can afford the premiums while smaller organizations will go unprotected and pay the costs of the outrage that will be deflected their way.
It's also possible a small to mid size organization gets into some imbroglio on Twitter and realizes they need a CDO to try and stop the bad PR.