You’re wrong. Every crypto company I’ve worked with has spent significant amounts on security consultants, audits, test nets, and bug bounties.