How did this person not get fired? Did they have board/executive backing? Significant ownership? Was it life or death for the startup to achieve "world class compliance"?
Speaking as someone who works in management. Knowing the difference between key stakeholders that you cannot afford to lose, and ones that are disposable are essential.
After we got acquired he started openly insulting management and the new company to their face in meetings in front of everyone. He did it on purpose but it still took quite a bit to get fired.
Most likely.
Nobody cares about security until they lose actual money because of it.
After that, your CISO now has the budget and importance defined by how much money the company got taken for.