I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
Shameless plug, this is why I co-founded Caution.