except BigCo also has tons of systems, autobackups, legacy code, and S3 buckets that's no one understands or has enough knowledge about. you know it's secure but you don't know what the downstream impact would be of making changes to those systems. so now you have to divert a ton of resources to figure things out - and no SWE in the company will willingly move to _that_ project.

while small companies don't have the big legal teams, they can just hire a consulting firm to go over it with them. they also have the benefit of being nimble, having smaller dependency trees, and typically using 3rd party tools which will generally implement this tooling anyways since their customers will likely need it. BigCo likely did a bunch of roll-your-own projects that have become black boxes over time.