You are rightly tearing his argument apart, but you have swung too far.

It is possible to sell trust and security as the major feature. If that's the case, then skipping security testing in favour of more features is not what most of your customers want. Especially if the CEO is so arrogant about it.

And maybe such a product is not the best money extracting operation. That can be ok, if the company/shareholders is ok with it... If not, things are misaligned somewhere.