In my experience, small teams put security off because someone on the dev team has some security experience, or thinks they do. But it is never the priority, there is always something more urgent to ship, and nobody has real skin in the game because it is not their job. Then shit happens. They rush to hire a security team, and that team spends the next few years fighting the culture.