This isn’t just billing related code. If they tell investors they have X active users, for example, the code that tracks active users is subject to the same standard.
Well.. again, you might be in for a surprise if you read the article. The also use codeowners to require authentication related code receive human eyes.
I read the article. I’m speaking from experience having worked for a large public company that was audited very recently. They will be required to add those requirements practically everywhere.