A large company may lose more than the value of the impacted business line while a startup is capped at the value of the business line (or rather the cash on hand which is even less). So the maximum loss is much higher in absolute terms for a large company and so they're able to invest more absolute money into security. Plus, philosophically, startups already have such massive risk that another X% due to a potential security breach isn't even worth bothering with versus spending the money on lowering risk in other areas.