However, I do want to call out his "Amazon was doing good business before 1999 and the end of the crypto wars", and "companies allocate just a small fraction of their security spend to cryptography":
* Prior to the end of export controls, Amazon was still doing SOTA cryptography
* Export controls themselves boiled down to clicking a link affirming you were an American, and then getting the strong-cryptography version of whatever it was you wanted; there were no teeth to them (at least not in software products)
* Prior to the widespread deployment of cryptography and, especially, of SSH, we had backbone-scale sniffing/harvesting attacks; at one point, someone managed to get solsniff.c running on some pinch point in Sprint and collected tens of thousands of logins. Lack of cryptographic protection was meaningful then in a way it isn't now because everything is encrypted.